CISA has added two critical Fortinet FortiSandbox vulnerabilities, CVE-2026-39808 and CVE-2026-25089, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation in real-world attacks. Both flaws are OS command injection vulnerabilities (CWE-78) that allow remote, unauthenticated attackers to execute arbitrary operating system commands by sending specially crafted HTTP requests. Successful exploitation requires no valid credentials, making these vulnerabilities particularly dangerous for internet-facing deployments.

The vulnerabilities impact multiple Fortinet products. CVE-2026-39808 affects FortiSandbox, while CVE-2026-25089 impacts FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. Because FortiSandbox is designed to analyze suspicious files, URLs, and malware and is often integrated with broader enterprise security infrastructure, compromising these systems can provide attackers with a valuable foothold for further attacks. Threat actors could leverage the flaws to deploy web shells, execute malicious commands, harvest credentials, disable security controls, move laterally across networks, or install additional malware.

CISA added both vulnerabilities to the KEV Catalog on July 16, 2026, highlighting the urgency of remediation. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are required to apply vendor-provided mitigations by July 19, 2026. Although there is no confirmed evidence linking these vulnerabilities to ransomware campaigns, their active exploitation, remote accessibility, and lack of authentication requirements significantly increase the risk of compromise, prompting organizations to prioritize remediation immediately.

Organizations are advised to promptly apply Fortinet's security updates and mitigation guidance across all affected environments, including FortiSandbox Cloud and FortiSandbox PaaS deployments. Security teams should identify and secure all internet-facing FortiSandbox instances, restrict access to management interfaces, monitor HTTP logs for suspicious or malformed requests, investigate unexpected command execution or unauthorized administrative accounts, and perform forensic triage to determine whether systems were compromised before patching. Where patches or mitigations are unavailable, organizations should follow Fortinet and CISA guidance or temporarily discontinue use of affected products until the risks have been addressed.