CISA added two Fortinet FortiSandbox vulnerabilities — CVE-2026-25089 and CVE-2026-39808 — to its Known Exploited Vulnerabilities catalog on July 17, 2026, setting a July 19 remediation deadline for Federal Civilian Executive Branch agencies and formally confirming that unauthenticated remote code execution flaws in the security appliance are being actively exploited.
CISA’s KEV Addition Confirms Active Exploitation of Both FortiSandbox CVEs
CVE-2026-25089 is a critical command injection vulnerability in Fortinet FortiSandbox that allows unauthenticated remote attackers to execute arbitrary code via low-complexity attacks against the sandbox management interface. CVE-2026-39808 is a separate unauthenticated remote code execution flaw in FortiSandbox via command injection — an additional RCE vector in the same product that had not previously appeared in published coverage of the FortiSandbox attack surface. Both vulnerabilities allow attackers to execute code on the FortiSandbox appliance without any authentication.
Threat intelligence firm Defused had reported exploitation of FortiSandbox vulnerabilities as early as June 16, 2026 — approximately one month before CISA’s official KEV confirmation on July 17. The month-long gap between Defused’s exploitation reporting and CISA’s formal action indicates that active attacks against FortiSandbox were underway well before the U.S. government issued its mandate.
Why CISA Set a Sunday Deadline for the FortiSandbox Patch
CISA’s Binding Operational Directive 26-04 provides up to three days for FCEB agencies to remediate newly added KEV vulnerabilities. Applied to a July 17 addition, the standard ceiling produces a July 19 deadline — a Sunday. CISA’s BOD 26-04 Sunday deadlines signal that CISA judges active attacks to be ongoing at the time of KEV addition, rather than representing potential future exploitation risk, and declines to extend the remediation window to the following business day.
A Sunday remediation deadline for two unauthenticated RCE vulnerabilities in a security appliance is an atypically aggressive enforcement posture from CISA. Federal network defenders must prioritize FortiSandbox patching through the weekend rather than deferring to Monday.
CVE-2026-39808 Expands the Known FortiSandbox Attack Surface
Prior coverage of the FortiSandbox vulnerabilities — including the three-CVE chaining technique disclosed in June — focused on CVE-2026-25089 as the lead vulnerability in the attack chain. CVE-2026-39808 was not part of that prior coverage and represents an additional unauthenticated RCE vector that CISA’s KEV action has now officially confirmed as actively exploited in the wild.
The addition of CVE-2026-39808 alongside CVE-2026-25089 means the exploitable attack surface against FortiSandbox has grown beyond what was previously documented. Organizations that had remediated only CVE-2026-25089 based on the June disclosures would have left CVE-2026-39808 unaddressed. CISA’s joint KEV addition makes clear that both CVEs require immediate patching.
The Consequences of Compromising a Security Sandbox Appliance
Fortinet FortiSandbox is a network security appliance deployed in enterprise and government environments for malware detonation, zero-day analysis, and advanced threat detection. The appliance receives potentially malicious files and code from across the organization for behavioral analysis inside an isolated execution environment — it occupies a security-critical position in the network, handling analysis of exactly the kinds of files that other defenses have flagged as suspicious.
Compromise of a FortiSandbox gives attackers access to the most sensitive tier of an organization’s security operations. An attacker with unauthorized access to a FortiSandbox can observe which threats the organization’s security team is actively investigating. Beyond passive surveillance, access to the sandbox environment enables an attacker to study the FortiSandbox’s detection logic and tune malware specifically to evade the sandbox’s behavioral analysis — effectively degrading one of the organization’s primary advanced threat detection capabilities from the inside.
CISA’s issuance of a Sunday deadline for federal FortiSandbox patching reflects the particular urgency that attaches to confirmed exploitation of security infrastructure. The combination of unauthenticated access requirements — no credentials needed for either CVE — and the sensitive forensic role FortiSandbox plays in enterprise and government security operations makes these two CVEs among the higher-consequence additions to the KEV catalog in recent months. The July 17 KEV action also confirms that active attacks have been ongoing for weeks before formal federal acknowledgment, a pattern that illustrates the gap between independent threat intelligence reporting and official government confirmation.
