CISA Catalogs Fortinet FortiSandbox Flaw CVE-2026-39808 in KEV Catalog

CISA has added a Fortinet FortiSandbox OS command injection vulnerability to its Known Exploited Vulnerabilities catalog.

CISA catalogs Fortinet FortiSandbox vulnerability. The flaw, tracked as CVE-2026-39808, could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. It was added to the catalog on 2026-07-16 with a federal remediation due date of 2026-07-19.

The vulnerability is described as an OS command injection issue in Fortinet FortiSandbox.

Required actions target federal agencies and stakeholders. Agencies must apply mitigations in accordance with vendor instructions. Compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk and the agency’s Forensics Triage Requirements is mandatory.

For cloud services, stakeholders must follow applicable BOD 26-04 guidance. If mitigations are unavailable, they must discontinue use of the product.

Stakeholders bear responsibility for exposure assessments. Each organization must evaluate every asset’s internet exposure. Adherence to BOD 26-04 patching guidelines is required.

The catalog entry appears alongside a separate Microsoft SharePoint deserialization of untrusted data vulnerability, CVE-2026-58644, also added on 2026-07-16 with the same due date. Both entries carry identical remediation language tied to BOD 26-04.