CISA added two critical unauthenticated OS command injection flaws in Fortinet FortiSandbox to KEV on July 16, 2026. BOD 26-04 gave FCEB agencies until July 19 to patch. Both are CVSS 9.1.
Researcher Bob Diachenko found an open attacker server holding plaintext admin and SSL VPN credentials for 73,932 FortiGate appliances across 194 countries. CISA issued reset guidance June 18.
Crafted HTTP requests against the FortiSandbox web UI yield OS command execution. CVSS 9.1. No active exploitation reported. Fixed in 5.0.6 and 4.4.9.
Arctic Wolf says attackers are using the pre-auth FortiClient EMS flaw to push a previously undocumented infostealer disguised as a Fortinet endpoint update.