FortiSandbox: CVE-2026-25089 and CVE-2026-39808 land in KEV, exploited

CISA added two critical Fortinet FortiSandbox vulnerabilities — CVE-2026-25089 and CVE-2026-39808 — to the Known Exploited Vulnerabilities catalog on July 16, 2026. Both are unauthenticated OS command injection flaws in the web management UI, rated CVSS 9.1. Under BOD 26-04, federal civilian agencies had until July 19, 2026 to patch. Fortinet's PSIRT covers them in FG-IR-26-141 and FG-IR-26-100.

What the bugs are

Both are CWE-78 improper neutralization of special elements in an OS command. Both let a remote unauthenticated attacker execute arbitrary system commands on the appliance by sending specially crafted HTTP requests to the FortiSandbox web UI. Same CVSS, same primitive, different endpoints — patched three months apart, dropped into KEV together.

• CVE-2026-25089 (FG-IR-26-141) — second-order command injection through JSON input to the start VNC web UI feature, patched in Fortinet's June 9, 2026 advisory batch.
• CVE-2026-39808 (FG-IR-26-100) — command injection through an unauthenticated API endpoint, patched in Fortinet's April 14, 2026 advisory batch.

FortiSandbox is Fortinet's malware-detonation appliance; a compromised sandbox typically sits on a management VLAN with visibility into every sample it inspects and the credentials to fetch them, which is exactly the pivot an intruder wants.

Affected versions

Per Fortinet's PSIRT advisories:

• CVE-2026-25089 — FortiSandbox 4.4.0 through 4.4.8, 5.0.0 through 5.0.5, plus FortiSandbox Cloud and PaaS deployments on those trains. Fix: upgrade to 4.4.9 or later, or 5.0.6 or later.
• CVE-2026-39808 — FortiSandbox 4.4.4 through 4.4.8, and FortiSandbox PaaS up to 23.4.4374. Fix: upgrade to 4.4.9 or later.

The overlapping 4.4.x window means most operators face one upgrade path — get to 4.4.9+ on the 4.4 train or 5.0.6+ on the 5.0 train and both are gone.

Exploitation status

Both confirmed in the wild — that is what earned the KEV listing on July 16. CISA has not named the intrusion set. Qualys' ThreatPROTECT writeup attributes the initial in-the-wild sightings to the Defused honeypot project, which flagged CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089 as under active probing. Secondary reporting from BleepingComputer and The Register confirms the KEV addition and the FCEB deadline. No public IOCs, YARA, or Sigma rules have been shipped by Fortinet or CISA as of writing.

The BOD 26-04 deadline of July 19, 2026 has already passed. If you operate a FortiSandbox and were not on 4.4.9+ or 5.0.6+ by Sunday, treat the appliance as potentially compromised, not just unpatched.

Action checklist

1. Upgrade to 4.4.9+ or 5.0.6+ today. One upgrade closes both CVEs. Cloud and PaaS tenants: verify with Fortinet support that your instance is on the fixed build; you do not control it directly.
2. Remove the web UI from the public internet. No production FortiSandbox management interface has a legitimate reason to answer HTTP from the wider internet. Restrict to the management VLAN, jump-host, or a bastion; block on the perimeter firewall regardless of what the appliance ACL says. Both CVEs require reachability to the web UI.
3. Assume compromise if the appliance was reachable and unpatched before July 19. Full compromise via CWE-78 gives the attacker the identity of the sandbox itself — pull the appliance offline, snapshot for forensics if you have DFIR capacity, and rebuild from a known-good image before returning it to production.
4. Rotate every credential the appliance held. Sample-fetch credentials for SMTP/IMAP, S3, network-share, EDR API keys, SSO tokens — anything the sandbox needed to acquire or detonate samples. A CWE-78 primitive on the box is a credential-exfil primitive too.
5. Audit connected log destinations. FortiSandbox typically forwards verdicts and IOCs to FortiAnalyzer, SIEM, or a SOAR. Verify that outbound telemetry has not been tampered with and that historical verdicts have not been rewritten by an attacker with root on the appliance.
6. Search egress logs for command-and-control candidates from the sandbox segment. A compromised detonation appliance often makes its own outbound calls under cover of the malware samples it is analyzing. Anything that looks like sandbox-originated C2 to a non-vendor IP over the last 90 days is worth pulling.

Context

This is the third exploited Fortinet vulnerability landing in KEV in 2026 on a pattern that keeps repeating: an appliance's web management interface, a command-injection primitive, weeks between patch availability and confirmed in-the-wild exploitation, then a compressed CISA remediation window. Fortinet's April 14 disclosure of CVE-2026-39808 gave defenders 93 days before KEV mandated action; the June 9 disclosure of CVE-2026-25089 gave them 37 days. The lesson recurring across these advisories is not that patching is hard, it is that FortiSandbox management interfaces still tend to face the internet in networks that would never let their FortiGate management face it — and each CWE-78 bug on the sandbox turns that architectural asymmetry into a full appliance takeover.