The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical Fortinet FortiSandbox vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, confirming that attackers are actively exploiting both flaws in real-world operations. The vulnerabilities, tracked as CVE-2026-39808 and CVE-2026-25089, are OS command injection flaws (CWE-78) that allow unauthenticated attackers to execute arbitrary operating system commands on affected devices by sending specially crafted HTTP requests. Organizations using FortiSandbox, particularly those with internet-facing deployments, face an elevated risk of compromise and should treat these vulnerabilities as urgent priorities.
FortiSandbox OS Command Injection Vulnerabilities: CVE-2026-39808 and CVE-2026-25089
Both vulnerabilities stem from improper sanitization of user-controlled input before it is passed to an operating system command interpreter. CVE-2026-39808 directly affects Fortinet FortiSandbox, enabling a remote, unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. CVE-2026-25089 carries a broader impact, affecting FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS environments. Like the first flaw, it can be exploited remotely without authentication and allows direct command execution on the target system.
FortiSandbox is designed to detect and analyze suspicious files, URLs, and malware within isolated environments. Because these systems frequently handle potentially malicious content and are often integrated with broader security infrastructure, a successful compromise can provide attackers with a significant foothold inside an organization’s network. Command injection vulnerabilities of this type are particularly dangerous because they bypass authentication requirements and grant attackers direct control over the underlying operating system.
Active Exploitation Confirmed and Federal Deadline Set
CISA added both CVEs to the KEV Catalog on July 16, 2026, confirming that exploitation has been observed in live attacks. Under Binding Operational Directive BOD 26-04, Federal Civilian Executive Branch agencies must implement vendor-provided mitigations by July 19, 2026. This three-day remediation window underscores the severity of the threat, especially given that the vulnerabilities are actively exploited and accessible over the internet.
While CISA has not confirmed whether these flaws have been used in ransomware campaigns, threat actors frequently leverage OS command injection vulnerabilities to deploy web shells, harvest credentials, move laterally across networks, disable security tools, or install additional malware. The absence of a ransomware link does not diminish the risk; organizations should treat these vulnerabilities as high-priority threats regardless of the attack vector.
What Affected Organizations Should Do Now
Administrators should immediately review Fortinet’s security advisories and apply all available patches and mitigations. Organizations using FortiSandbox Cloud or FortiSandbox PaaS must verify that their service deployments comply with the required updates. Security teams should identify all internet-facing FortiSandbox assets, restrict access to management interfaces, and review HTTP logs for unusual or malformed requests that may indicate attempted exploitation. Any unexpected command executions or new administrative accounts should be investigated without delay.
If patches or mitigations are not yet available, CISA recommends that organizations follow relevant cloud service guidance or discontinue use of the affected products until the risks are fully addressed. In addition to patching, teams should conduct forensic triage in accordance with CISA’s guidelines to determine whether systems were compromised before remediation was applied. For organizations without dedicated incident response capabilities, engaging a reputable incident response service with expertise in Fortinet environments can help ensure thorough assessment and containment.
As a general security practice, all internet-exposed management interfaces should be restricted to trusted IP ranges or placed behind a VPN or bastion host. Organizations should also implement multi-layer endpoint protection and network monitoring solutions capable of detecting anomalous command execution patterns. Prompt action on these vulnerabilities is essential to prevent attackers from establishing persistence within critical infrastructure.
