CISA added three critical operating system command injection vulnerabilities in Fortinet FortiSandbox to its Known Exploited Vulnerabilities catalog on 16 July 2026, with a binding patch deadline of 19 July for US federal agencies. All three carry CVSS scores of 9.1 and enable unauthenticated remote code execution on vulnerable appliances. Active exploitation has been confirmed across on-premises, cloud, and PaaS deployments.
The Vulnerabilities
Three CVEs are in scope:
CVE-2026-39808 — An OS command injection flaw in FortiSandbox versions 4.4.0 through 4.4.8. An unauthenticated attacker can execute arbitrary commands on the appliance by sending specially crafted HTTP requests. No credentials required. Fortinet released a fix in FortiSandbox version 4.4.9 in April 2026.
CVE-2026-25089 — A second OS injection vulnerability with identical severity, affecting both on-premises FortiSandbox and hosted FortiSandbox Cloud and PaaS deployments. The expanded attack surface — including cloud-managed instances that many organisations assume Fortinet patches automatically — makes this the higher operational risk of the two. Fortinet issued a fix in June 2026.
CVE-2026-39813 — A third injection flaw affecting the same product family, also under active exploitation. Exploitation guidance is less developed than for the other two CVEs, but confirmation of active use means it cannot be deprioritised.
All three share the same root cause: improper sanitisation of user-supplied input before it reaches OS-level command execution. The class is well-understood, defences against it are established, and the presence of three separate instances in the same product suggests a systemic input-handling issue rather than isolated oversights.
Context
FortiSandbox is an enterprise network security appliance used for sandboxed analysis of suspected malicious files and network traffic. It sits at a privileged position in the network: traffic from endpoints, email gateways, and web proxies passes through or is inspected by it. Compromising the sandbox can allow attackers to understand which files trigger detection and which evade it, creating an asymmetric advantage in later-stage operations.
The exploitation timeline is relevant. Fortinet patched CVE-2026-39808 in April and CVE-2026-25089 in June. Active exploitation was confirmed by threat intelligence firm Defused in late June and early July. CISA added the vulnerabilities to the KEV catalog on July 16 — the time from available patch to CISA-mandated action for federal agencies spans roughly two to three months for these flaws. Organisations that patch against KEV additions rather than vendor advisories have been operating with unpatched exposure for most of that window.
The Register’s reporting on July 17 notes that while an exploit for CVE-2026-25089 has been observed, it appears to be poorly engineered and has not produced reliable results in all tested configurations. This is not a reason to delay patching; initial exploit quality rarely reflects the final state of tools developed with access to an active CVE.
What This Means for Affected Sectors
FortiSandbox is deployed across enterprise security stacks in finance, critical infrastructure, healthcare, and large-scale commercial operations. Organisations running it as part of their email security pipeline or SOC tooling should treat this as a production incident requiring emergency patch priority, not a routine patch cycle item.
Cloud and PaaS customers should verify with Fortinet support whether their hosted instances have been updated. The assumption that cloud products are patched automatically does not hold here: CVE-2026-25089 affects cloud and PaaS deployments, and organisations should obtain written confirmation of patch status from their account team rather than assuming coverage.
Recommended Actions
Immediate: Identify all FortiSandbox deployments — on-premises, FortiSandbox Cloud, and PaaS. Confirm version numbers against the patched releases (4.4.9 or later for CVE-2026-39808; June release series for CVE-2026-25089).
Within 24-48 hours: Apply available patches. If patching is not immediately possible, review whether the management interface is accessible from untrusted networks. Restrict access to FortiSandbox management to dedicated management VLANs or jump hosts as a compensating control.
Investigation: Review FortiSandbox logs for anomalous HTTP requests to management interfaces in the period prior to patching. Exploitation attempts will be visible in access logs if logging is enabled at the relevant verbosity level.
Notification: If your organisation is a US federal agency or a federal contractor with BOD-scope systems, confirm patch completion status with your CISO before July 19.
For organisations outside the US federal scope, the commercial risk profile is equivalent. A CISA KEV addition with confirmed active exploitation at CVSS 9.1 represents a disclosure condition that most enterprise patch SLAs treat as emergency priority.