CISA Catalogs Fortinet FortiSandbox Flaw CVE-2026-39808 in KEV Catalog

CISA added the Fortinet FortiSandbox OS command injection vulnerability CVE-2026-39808 to its Known Exploited Vulnerabilities catalog on 2026-07-16. Federal agencies have until 2026-07-19 to apply vendor mitigations under BOD 26-04 or discontinue use if patches are unavailable.

Source:CISA KEV

Post

CISA Catalogs Fortinet FortiSandbox Flaw CVE-2026-39808 in KEV Catalog

TL;DRAI · 60 sec read

CISA has added a Fortinet FortiSandbox OS command injection vulnerability to its Known Exploited Vulnerabilities catalog.

CISA catalogs Fortinet FortiSandbox vulnerability. The flaw, tracked as CVE-2026-39808, could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. It was added to the catalog on 2026-07-16 with a federal remediation due date of 2026-07-19.

The flaw, tracked as CVE-2026-39808, could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.

The vulnerability is described as an OS command injection issue in Fortinet FortiSandbox.

Required actions target federal agencies and stakeholders. Agencies must apply mitigations in accordance with vendor instructions. Compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk and the agency’s Forensics Triage Requirements is mandatory.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

For cloud services, stakeholders must follow applicable BOD 26-04 guidance. If mitigations are unavailable, they must discontinue use of the product.

If mitigations are unavailable, they must discontinue use of the product.

Stakeholders bear responsibility for exposure assessments. Each organization must evaluate every asset’s internet exposure. Adherence to BOD 26-04 patching guidelines is required.

The catalog entry appears alongside a separate Microsoft SharePoint deserialization of untrusted data vulnerability, CVE-2026-58644, also added on 2026-07-16 with the same due date. Both entries carry identical remediation language tied to BOD 26-04.

EXPERT TAKE

Enterprises running on-premises SharePoint should treat this KEV addition as an immediate patching priority given confirmed active exploitation.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

Microsoft SharePoint Security Vulnerability CISA

MORE IN TECH

NASA and SpaceX Prepare for Nancy Grace Roman Space Telescope Launch

NASA and SpaceX are targeting a 7:26 AM EDT Sunday liftoff of a Falcon Heavy from Kennedy Space Center carrying the Nancy Grace Roman Space Telescope. The observatory will travel to Sun-Earth L2, where its Wide Field and Coronagraph instruments will search for exoplanets and study dark energy.

Carhartt data breach exposes 12.9 million accounts

ShinyHunters published data from 12.9 million genuine Carhartt accounts after the apparel company refused a $3.3 million ransom. The breach, which also exposed records for more than 15,000 employees, originated from Carhartt's Databricks analytics platform.

Nvidia Agrees to Acquire Hugging Face for $12.9 Billion

Nvidia has agreed to acquire open-source AI platform Hugging Face for $12.9 billion according to The Information. The deal would expand Nvidia's reach into the software and model ecosystem while highlighting its bet on continued AI demand growth.