CISA urges immediate action on actively exploited Fortinet flaws

Two critical unauthenticated remote code execution vulnerabilities in Fortinet FortiSandbox are being actively exploited in the wild, requiring no user interaction — making them especially dangerous for internet-facing deployments. The root cause is unpatched network security appliances that remain exposed despite available fixes, a recurring pattern in high-severity incidents targeting government and enterprise infrastructure. CISA's Binding Operational Directive underscores that delayed patching of critical network appliances creates an unacceptable risk window for adversaries. This matters because security appliances like FortiSandbox are often highly trusted within network architectures, meaning a compromise can grant attackers deep, persistent access. Organizations that lack a rapid, prioritized patching process for critical vulnerabilities are consistently the most exposed.