CISA adds Fortinet FortiSandbox flaw (CVE-2026-25089) to KEV

On July 16, 2026, CISA (the U.S. cybersecurity agency) added CVE-2026-25089 to its Known Exploited Vulnerabilities catalog, the KEV. The flaw is an operating-system command injection (CWE-78) in Fortinet FortiSandbox. Inclusion in the catalog means there is evidence the weakness is being used by attackers in the wild. The detail that demands immediate attention: exploitation requires no authentication and no victim interaction. An attacker can send crafted HTTP requests to the appliance and run commands on the system without prior credentials. The flaw reaches the on-premises, Cloud, and PaaS editions of the product.

Why it matters

FortiSandbox is a defensive component: it detonates suspicious files in an isolated environment to catch malware before it reaches users. When a tool like this becomes an entry point, the effect is twofold. First, the attacker gains command execution on a system that usually has broad visibility into the traffic and artifacts analyzed across the network. Second, a silent compromise there can turn the detection layer itself into a staging ground for lateral movement, without triggering the alerts an organization would expect.

A KEV listing is not a formality. It signals that exploitation has moved beyond theory. For U.S. federal civilian agencies, directive BOD 26-04 set a remediation deadline around July 19, 2026. Private companies in Brazil and Latin America are not bound by that legal mandate, but the risk logic is identical: a critical, unauthenticated flaw, with confirmed exploitation, on a device that is often exposed to the network.

What to do

• Inventory every FortiSandbox instance (on-premises, Cloud, and PaaS) and apply Fortinet’s fixed releases as soon as possible.
• Restrict access to the management interface: never expose the panel directly to the internet, and limit it to trusted administrative networks.
• Review HTTP request logs to the appliance for anomalous patterns, assuming a compromise may predate the patch.
• Treat KEV catalog vulnerabilities as a priority in your patch management process, even without a regulatory obligation.