CISA Adds Fortinet FortiSandbox Vulnerabilities to KEV Catalog: Command Injection Enables Unauthenticated Remote Code Execution
CISA added two Fortinet FortiSandbox OS command injection vulnerabilities to the Known Exploited Vulnerabilities catalog. Unauthenticated attackers can execute arbitrary commands via crafted HTTP requests; federal agencies must remediate by July 19, 2026.
Incident overview
On July 16, 2026, CISA added two Fortinet FortiSandbox vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog. Both are OS command injection flaws. Unauthenticated attackers can execute unauthorized code or commands via crafted HTTP requests. Under CISA BOD 26-04, federal civilian agencies must apply vendor patches or mitigations by July 19, 2026.
Technical details
CVE-2026-39808
Affected product Fortinet FortiSandbox
Vulnerability type OS command injection
Exploitation requirements No authentication; network-reachable
Attack vector Crafted malicious HTTP request
CISA catalog date July 16, 2026
Remediation deadline July 19, 2026
CVE-2026-25089
Affected product Fortinet FortiSandbox, FortiSandbox Cloud, FortiSandbox PaaS
Vulnerability type OS command injection
Exploitation requirements No authentication; network-reachable
Attack vector Crafted malicious HTTP request
CISA catalog date July 16, 2026
Remediation deadline July 19, 2026
How it works
FortiSandbox is Fortinet's advanced threat detection and sandbox analysis platform. It executes suspicious files in isolation and analyzes behavior. The flaws sit in the web management interface or API endpoints: user input is concatenated into OS commands without sufficient sanitization.
An attacker sends a crafted HTTP request injecting shell metacharacters (semicolon, backtick, pipe, etc.) so the device runs attacker-specified system commands. No authentication is required. Internet-exposed FortiSandbox instances are high risk.
Impact assessment
FortiSandbox is widely deployed in enterprise SOCs and data centers as a last-line boundary threat detector. Successful exploitation lets an attacker:
- Obtain root/system command execution on the sandbox appliance
- Tamper with sandbox analysis results so malicious files are marked clean
- Pivot from the sandbox into other internal security devices and management networks
- Extract historically submitted sensitive file samples from the sandbox
CISA BOD 26-04 requires federal agencies to prioritize internet-exposure assessment and complete patching before the deadline. Cloud instances must follow corresponding cloud patching guidance. If mitigations are unavailable, take the product offline.
Remediation
Official patches
Fortinet published advisories and patches via FortiGuard PSIRT:
- FG-IR-26-100 (CVE-2026-39808)
- FG-IR-26-141 (CVE-2026-25089)
Log in to the Fortinet support portal and download firmware updates for the corresponding FortiSandbox version.
Temporary mitigations
- Restrict FortiSandbox management-interface access to trusted management segments only
- Block unauthorized inbound traffic to FortiSandbox web ports at the perimeter firewall
- Enable FortiSandbox log auditing; monitor anomalous HTTP request patterns
- Isolate internet-exposed instances until patches are applied
Detection
- Network: monitor FortiSandbox HTTP traffic for URIs or parameters containing shell metacharacters
- Host: monitor FortiSandbox OS for unexpected process spawning
- SIEM: correlate FortiSandbox logs with network traffic alerts
References
- CISA Known Exploited Vulnerabilities catalog
- Fortinet PSIRT FG-IR-26-100
- Fortinet PSIRT FG-IR-26-141
- CISA BOD 26-04