CISA Warns of Critical Fortinet FortiSandbox OS Injection Flaws Exploited in Attacks

Key Takeaways

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding two critical OS command injection vulnerabilities impacting Fortinet FortiSandbox products.
• Identified as CVE-2026-39808 and CVE-2026-25089, these flaws permit unauthenticated attackers to execute arbitrary commands remotely through specially crafted HTTP requests.
• Both vulnerabilities have been actively exploited in real-world attacks, prompting CISA to add them to its Known Exploited Vulnerabilities (KEV) Catalog.
• Affected products include FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS environments.
• Organizations are mandated to apply vendor-provided mitigations immediately, with federal agencies facing a strict deadline of July 19, 2026.

CISA Issues Urgent Alert for Exploited Fortinet FortiSandbox Flaws

The Cybersecurity and Infrastructure Security Agency (CISA) has sounded the alarm on two critical vulnerabilities within Fortinet’s FortiSandbox suite, confirming that these flaws are under active exploitation by threat actors. The agency has officially listed both issues in its Known Exploited Vulnerabilities (KEV) Catalog, underscoring the immediate threat they pose.

These vulnerabilities, tracked as CVE-2026-39808 and CVE-2026-25089, are classified as OS command injection weaknesses (CWE-78). This type of flaw arises when an application fails to adequately sanitize user input before passing it to an operating system command interpreter. The result is a critical security bypass, enabling unauthenticated attackers to execute unauthorized operating system commands merely by sending specially crafted HTTP requests to vulnerable devices.

Deep Dive into FortiSandbox Vulnerabilities

CVE-2026-39808 directly impacts Fortinet FortiSandbox. CISA’s advisory indicates that a remote, unauthenticated attacker could leverage this vulnerability to execute arbitrary code or commands on the targeted device. This level of access bypasses the need for any valid credentials, making it an attractive target for malicious actors.

The second vulnerability, CVE-2026-25089, presents an even broader risk profile. Its impact extends beyond standalone FortiSandbox deployments to include FortiSandbox Cloud and FortiSandbox PaaS environments. Similar to CVE-2026-39808, this flaw allows unauthenticated remote attackers to achieve direct command execution on affected systems via malicious HTTP requests.

FortiSandbox products are crucial components in many organizations’ security postures, designed to detect and analyze suspicious files, URLs, and malware within isolated environments. Given their role in handling potentially malicious content and their integration with broader security infrastructure, a successful compromise of these systems could provide attackers with a significant and dangerous foothold within an organization’s network.

Urgent Remediation Required

CISA added both vulnerabilities to the KEV Catalog on July 16, 2026, a clear indication of their active exploitation. In response, Federal Civilian Executive Branch agencies are mandated to implement vendor-provided mitigations by July 19, 2026, in compliance with Binding Operational Directive BOD 26-04. This extremely tight remediation window highlights the severe and immediate risk posed by these internet-accessible and actively exploited vulnerabilities.

While CISA has not explicitly confirmed if these vulnerabilities are being used in ransomware campaigns, the nature of command injection flaws makes them prime targets for such attacks. Threat actors commonly exploit these vulnerabilities to deploy web shells, harvest credentials, facilitate lateral movement within networks, disable security tools, or install various forms of malware.

What You Should Do

• Apply Updates Immediately: Administrators must promptly review Fortinet’s advisories and apply all available security updates and mitigations for FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS.
• Identify and Secure Assets: Identify all internet-facing FortiSandbox assets and restrict access to management interfaces to authorized personnel and IP addresses only.
• Monitor for Anomalies: Scrutinize HTTP logs for any unusual or malformed requests, and investigate any unexpected command executions or the creation of new administrative accounts.
• Forensic Triage: Follow CISA’s forensic triage requirements to determine if systems were compromised prior to the application of remediation steps.
• Discontinue Use if Unpatched: If patches or mitigations are unavailable, CISA advises adhering to relevant cloud service guidance or discontinuing the use of affected products until the risks are fully addressed.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.