VulnerabilityBleeping Computer
9.8 — CRITICAL
CISA urges immediate action on actively exploited Fortinet flaws
CISA on Thursday ordered government agencies to prioritize patching two actively exploited vulnerabilities in the Fortinet FortiSandbox threat detection platform. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned government agencies to immediately patch two actively exploited vulnerabilities in Fortinet's FortiSandbox threat detection platform, CVE-2026-39808 and CVE-2026-25089, which allow unauthenticated attackers to execute unauthorized code remotely through low-complexity command injection attacks.
⚙️Technical Details
CVEs
CVE-2026-39808CVE-2026-25089CVE-2026-39813
Affected Systems
Fortinet FortisandboxFortinet Fortisandbox CloudFortinet Fortisandbox PaaS
Attack Vectors
os command injectionpath traversal
💥Impact Assessment
Severity: Critical
Who Is at Risk
Government agencies and organizations using Fortinet's FortiSandbox threat detection platform
🛡️Recommended Actions
1Immediately upgrade all affected deployments to the latest released versions of Fortinet's FortiSandbox threat detection platform
2Monitor for suspicious activity and implement additional security controls to prevent exploitation
3Conduct a thorough vulnerability assessment and patch any other vulnerable systems
📦Affected Products
Fortinet FortisandboxFortinet Fortisandbox CloudFortinet Fortisandbox PaasFortinet ForticlientemsFortinet FortiosFortinet FortipamFortinet FortiproxyFortinet FortiswitchmanagerFortinet Fortisandbox PaaS
🔐NVD Verified DataVERIFIED
CVE-2026-39808 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-78
Affected Products (CPE)
Fortinet Fortisandbox
CVE-2026-25089 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-78
Affected Products (CPE)
Fortinet FortisandboxFortinet Fortisandbox CloudFortinet Fortisandbox Paas
CVE-2026-39813 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-24
Affected Products (CPE)
Fortinet Fortisandbox
CVE-2026-21643 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-89
Affected Products (CPE)
Fortinet Forticlientems
CVE-2025-61624 ↗CVSS 6.5 — MEDIUM
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:HWeaknesses
CWE-22
Affected Products (CPE)
Fortinet FortiosFortinet FortipamFortinet FortiproxyFortinet Fortiswitchmanager
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.