CISA gives federal agencies a weekend to patch two Fortinet flaws already under attack

Key points

• The U.S. Cybersecurity and Infrastructure Security Agency, known as CISA, on Thursday ordered federal agencies to patch two Fortinet FortiSandbox flaws that hackers are actively exploiting.
• The two bugs, CVE-2026-39808 and CVE-2026-25089, let an outsider run their own code on the device with no login and no user click required.
• Fortinet fixed CVE-2026-39808 on April 14 and CVE-2026-25089 on June 9 in separate security advisories.
• Threat intelligence firm Defused reported on June 16 that attackers had started using both bugs in real attacks.
• Federal agencies must patch by Sunday, July 19 under Binding Operational Directive 26-04.

America's cyber agency has told federal staff to drop what they're doing and patch two Fortinet products this weekend.

The order, issued Thursday by CISA, covers Fortinet FortiSandbox, a security appliance companies use to detonate suspicious files in a sealed-off environment and watch for misbehaviour. It's meant to catch malware. Right now it's the thing being attacked.

Both flaws are rated critical. They let a stranger on the internet send a specially crafted request and make the device run commands. No password needed. No employee tricked into clicking anything. Just send the packet and you're in.

In web-security terms, this is command injection: a bug where user input gets fed straight into a system command the server then executes. It's one of the oldest attack classes on record. It shouldn't still be appearing in security appliances in 2026. It does.

Who is actually being hit?

Fortinet hasn't publicly confirmed either bug is being used in the wild and hadn't replied to BleepingComputer's emails at the time of that outlet's report. Defused said on June 16 it was watching live exploitation of multiple FortiSandbox flaws, including these two alongside CVE-2026-39813.

Defused called one of the exploits "vibecoded," its way of saying someone probably wrote it with an AI assistant and it doesn't quite work. Worth pausing on. The barrier to writing a rough exploit has dropped considerably. The exploits are sloppier, but they arrive faster and in greater volume.

We first covered CVE-2026-39808 and CVE-2026-25089 on 16 July 2026 in "CISA Flags Three Actively Exploited Bugs in Fortinet and SharePoint", when CISA added both to its Known Exploited Vulnerabilities catalog alongside a Microsoft SharePoint flaw. Under Binding Operational Directive 26-04, a rule compelling federal civilian agencies to patch listed flaws on a fixed deadline, agencies have until Sunday, July 19.

Should you worry?

FortiSandbox isn't a product you have at home. It sits inside corporate and government networks, screening files before they reach staff. The direct risk is theirs to manage.

But the wider pattern matters. Fortinet gear has been a favourite target for years. CISA now tracks 28 Fortinet flaws used in real attacks, and 13 have appeared in ransomware cases, where criminals encrypt a company's files and demand payment for the decryption key.

Earlier this year Fortinet patched a critical SQL injection bug, CVE-2026-21643, in its FortiClient Enterprise Management Server. Defused flagged it as actively exploited about a month after the fix landed. Then came CVE-2025-61624, a path traversal flaw that lets an authenticated attacker climb outside their permitted folder and reach files they shouldn't see.

The answer in every case is the same: upgrade to the patched version now, not next quarter. If your bank or council uses Fortinet gear, and many do, this kind of housekeeping decides whether their next Monday is quiet or catastrophic.