CISA Orders Emergency Patch for Actively Exploited FortiSandbox Flaws by Sunday

CISA on Thursday ordered government agencies to prioritize patching two actively exploited

Here's the kind of deadline that makes your stomach drop: CISA gave U.S. federal agencies four days to patch two critical Fortinet FortiSandbox vulnerabilities that threat actors are already weaponizing in the wild. The Binding Operational Directive (BOD) 26-04, issued Thursday July 16, sets the compliance bar at Sunday, July 19 — that's it. No extensions. No grace period.

The two flaws, tracked as CVE-2026-39808 and CVE-2026-25089, both carry a CVSS score of 9.1 and both allow unauthenticated remote code execution through OS command injection. No login required. No user interaction needed. Just a crafted HTTP request and you're handing an attacker full control of the sandbox appliance.

CISA confirmed active exploitation and added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog the same day it issued the directive. Fortinet itself hasn't publicly confirmed in-the-wild abuse, but threat intel firm Defused had already flagged active exploitation on June 16 — over a month before CISA got involved.

The fix is straightforward: upgrade to FortiSandbox 4.4.9 or above. If you're still running anything from 4.4.0 through 4.4.8, you're sitting on a target that attackers already know how to hit.

The Two Command Injection Flaws Explained

Both CVE-2026-39808 and CVE-2026-25089 are OS command injection vulnerabilities — specifically, an improper neutralization of special elements used in OS commands (CWE-78). The distinction between them comes down to scope.

CVE-2026-39808 affects only FortiSandbox 4.4 versions 4.4.0 through 4.4.8. FortiSandbox 5.0 is explicitly not affected — the vulnerability was introduced in the 4.4 codebase and never made it into the 5.x branch. Fortinet published the patch for this one on April 14, 2026, after it was reported by Samuel de Lucas Maroto from KPMG Spain under responsible disclosure. The attack vector is unauthenticated, meaning anyone on the network can attempt exploitation.

CVE-2026-25089 is broader. It hits FortiSandbox 4.4 (same versions: 4.4.0 through 4.4.8), but also affects FortiSandbox Cloud and the FortiSandbox PaaS WEB UI. Patched June 9, 2026. Same attack profile: unauthenticated OS command injection via crafted HTTP requests to the WEB UI.

The low complexity of both exploits is what makes them dangerous at scale. You don't need a sophisticated toolchain or deep knowledge of the FortiSandbox internals to weaponize these. The Qualys ThreatPROTECT team noted that one of the in-the-wild exploits for CVE-2026-25089 appeared to be "vibecoded, likely faulty" — meaning even a sloppy, half-baked exploit was enough to compromise systems. That tells you everything about the attack surface.

There's also CVE-2026-39813, a path traversal vulnerability (CWE-24) in the FortiSandbox JRPC API that allows unauthenticated authentication bypass and privilege escalation. While CISA's directive focuses on the two command injection flaws, this one is worth noting: it affects FortiSandbox 5.0.0 through 5.0.5 and 4.4.0 through 4.4.8, with FortiSandbox 5.2 explicitly not affected. The fix is the same upgrade path — 4.4.9 or 5.0.6.

In-the-Wild Exploitation Timeline

The timeline on this one is worth understanding because it shows how quickly the gap between patch availability and active exploitation can close.

Fortinet patched CVE-2026-39808 on April 14. CVE-2026-25089 got its patch on June 9. Then on June 16 — just seven days after the second patch dropped — Defused threat intelligence reported active exploitation of all three vulnerabilities simultaneously:

"We are observing exploitation of multiple Fortinet FortiSandbox vulnerabilities during the past 24 hours, including: CVE-2026-39813 (no previous recorded exploitation), CVE-2026-39808, CVE-2026-25089 (vibecoded, likely faulty exploit)."

That's a three-week window between patch release and confirmed weaponization for CVE-2026-39808. For context, that's well within the typical "window of exposure" that CISA tries to close with its emergency directives.

CISA's KEV catalog entry and BOD 26-04 came roughly five weeks after the initial Defused report. By the time the directive landed, agencies had already lost ground. The patch existed for months. The exploitation was confirmed weeks ago. What happened in between is the familiar story: organizations that didn't prioritize sandbox appliance patching because, well, it's a detection tool, not a perimeter device.

That assumption just got a lot more expensive.

Mitigation and Affected Versions

Here's the remediation matrix, broken down by CVE:

For agencies covered by BOD 26-04, the directive is clear: patch FortiSandbox instances running any version from 4.4.0 through 4.4.8 to at least 4.4.9 by Sunday, July 19.

If you're running FortiSandbox Cloud or the PaaS WEB UI, that falls under CVE-2026-25089 and the same upgrade applies. Organizations on the 5.0 branch need to get to 5.0.6 minimum if they want to close CVE-2026-39813 as well.

For detection before patching, Qualys customers can scan with QIDs 531193, 531194, 531538, 733996, 734396, 733994, and 734082. QID 734082 requires Enterprise TruRisk Management access.

One thing worth calling out: FortiSandbox 5.2 is not affected by any of these three vulnerabilities. If you've already migrated there, you're clean on this round. But don't let that create a false sense of security — Fortinet's track record with this product line means the next one is probably already in someone's toolkit.

The Bigger Picture: Fortinet's Exploitation Track Record

Fortinet products are not strangers to the KEV catalog. CISA tracks 28 Fortinet vulnerabilities that have been exploited in attacks over recent years, and 13 of those have also been abused in ransomware campaigns. That's a pattern, not coincidence.

The FortiSandbox line has been hit repeatedly. In February 2026, Fortinet patched a critical SQL injection vulnerability (CVE-2026-21643) in the FortiClient Enterprise Management Server — Defused flagged it as actively exploited one month later. Two months before that, a path traversal flaw (CVE-2025-61624) in FortiSandbox allowed authenticated attackers to escalate privileges.

This isn't a new problem. It's an ongoing one. Fortinet vulnerabilities show up in both cyber espionage campaigns and ransomware operations with regularity, often as zero-days that get weaponized before patches are even available. The FortiSandbox command injection flaws we're dealing with now follow that exact playbook: patch released in April, exploitation confirmed by June, CISA directive by July.

The pattern suggests that threat actors are actively monitoring Fortinet's PSIRT advisories and building exploits in parallel with the patch development cycle. Which means the four-day deadline CISA set for federal agencies isn't just tight — it's almost certainly too late for any organization that hasn't already patched.

For security teams managing FortiSandbox deployments, the takeaway is blunt: treat every Fortinet PSIRT advisory as a priority-one event. The gap between "patch available" and "actively exploited" keeps shrinking, and this time it was measured in weeks, not months.