CISA Adds Actively Exploited Fortinet FortiSandbox Flaw to KEV Catalog
CISA has confirmed active exploitation of an OS command injection vulnerability in Fortinet FortiSandbox, mandating urgent remediation for federal agencies.
Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS are affected by an OS command injection vulnerability, tracked as CVE-2026-25089. This security flaw, categorized as CWE-78, allows an unauthenticated attacker to execute unauthorized commands on the system by sending specifically crafted HTTP requests.
The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog as of July 16, 2026, confirming its use in real-world attacks. Federal agencies are required to apply necessary mitigations by July 19, 2026, in accordance with BOD 26-04 guidelines.
Organizations are advised to follow vendor instructions to secure their deployments. Stakeholders must evaluate the internet exposure of their assets and ensure compliance with CISA's forensics triage requirements and patching guidance. If mitigations are unavailable for cloud services, agencies should discontinue use of the product.
Sources
- CISA KEV Original source
Continue Reading
SecurityA hands-on way to gauge AI ransomware risk
OWASP volunteers released RAID-AI, a free manual self-assessment that maps AI controls to NIST and CISA frameworks.
SecurityAWS AgentCore Flaw Let One Prompt Hijack All Agents
Researchers say a single chat prompt could extract cloud credentials and let an attacker take over every AgentCore agent in an AWS account and region.
SecurityLightwell Uncovers 400+ Java Library Flaws
IBM and Red Hat's Lightwell project has identified over 400 novel vulnerabilities in Java libraries, launching a clearinghouse service for customers to submit code for review.