[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0ygZjGjYLaxd9tUD3-xWw0UVCE_rIVw7xA-l1SeoOWU":3},{"article":4,"iocs":50,"watch_terms":66,"solutions":67,"lesson":163},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"32797ea2-0f1e-4ead-a24a-8131227254a1","CISA urges immediate action on actively exploited Fortinet flaws","cisa-urges-immediate-action-on-actively-exploited-fortinet-flaws-d70c88","CISA on Thursday ordered government agencies to prioritize patching two actively exploited vulnerabilities in the Fortinet FortiSandbox threat detection platform. [...]","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered government agencies to immediately patch two critical vulnerabilities (CVE-2026-39808 and CVE-2026-25089) in Fortinet FortiSandbox that are actively exploited in the wild. These flaws allow unauthenticated remote code execution via command injection with no user interaction required. Federal agencies must complete patching by July 19 under the Binding Operational Directive (BOD) 26-04.","CISA orders federal agencies to patch two actively exploited Fortinet FortiSandbox vulnerabilities by July 19.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisa-warns-feds-to-patch-exploited-fortinet-fortisandbox-flaws-by-sunday\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F06\u002F19\u002FFortinet.jpg","2026-07-17T07:03:33+00:00","2026-07-17T08:00:18.045771+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"Fortinet","vendor",{"name":21,"type":22},"FortiSandbox","product",{"name":24,"type":22},"FortiClient EMS",{"name":26,"type":19},"CISA",{"name":28,"type":19},"Defused","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":29,"icon":31,"name":32,"slug":33},null,"Zero-day","zero-day",[35,40,45],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",[51,55,57,60,63],{"type":52,"value":53,"context":54},"cve","CVE-2026-39808","Critical remote code execution vulnerability in Fortinet FortiSandbox, actively exploited",{"type":52,"value":56,"context":54},"CVE-2026-25089",{"type":52,"value":58,"context":59},"CVE-2026-39813","Fortinet FortiSandbox vulnerability with no previous recorded exploitation, observed in attacks",{"type":52,"value":61,"context":62},"CVE-2026-21643","Critical SQL injection vulnerability in Fortinet FortiClient EMS, actively exploited",{"type":52,"value":64,"context":65},"CVE-2025-61624","Path traversal privilege escalation vulnerability in Fortinet, exploited in attacks",[18,26,28],{"controls":68,"vendors":152},[69,98,123],{"slug":70,"name":71,"problem":72,"products":73},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":99,"name":100,"problem":101,"products":102},"patch-management","Automated patch management","Known holes get closed in days, not months.",[103,111,115],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":99,"product_name":112,"url":113,"description":114},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":124,"name":125,"problem":126,"products":127},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",[153,158],{"slug":154,"name":28,"logo_path":155,"roles":156},"defused","\u002Fvendor-logos\u002Fdefused.png",[157],"reported_by",{"slug":159,"name":18,"logo_path":160,"roles":161},"fortinet","\u002Fvendor-logos\u002Ffortinet.png",[162],"affected",{"slug":164,"title":165,"body":166,"framework_refs":167,"framework_notes":179},"critical-fortinet-flaws-actively-exploited-immediate-patching-required","Critical Fortinet Flaws Actively Exploited — Immediate Patching Required","Two critical unauthenticated remote code execution vulnerabilities in Fortinet FortiSandbox are being actively exploited in the wild, requiring no user interaction — making them especially dangerous for internet-facing deployments. The root cause is unpatched network security appliances that remain exposed despite available fixes, a recurring pattern in high-severity incidents targeting government and enterprise infrastructure. CISA's Binding Operational Directive underscores that delayed patching of critical network appliances creates an unacceptable risk window for adversaries. This matters because security appliances like FortiSandbox are often highly trusted within network architectures, meaning a compromise can grant attackers deep, persistent access. Organizations that lack a rapid, prioritized patching process for critical vulnerabilities are consistently the most exposed.",[168,169,170,171,172,173,174,175,176,177,178],"CIS Control 7.1 – Establish and Maintain a Vulnerability Management Process","CIS Control 7.4 – Perform Automated Application Patch Management","CIS Control 12.2 – Establish and Maintain a Secure Network Architecture","NIST SP 800-40 Rev. 4 – Guide to Enterprise Patch Management Planning","NIST SI-2 – Flaw Remediation","NIST RA-5 – Vulnerability Monitoring and Scanning","NIST CM-6 – Configuration Settings","CISA BOD 22-01 – Reducing the Significant Risk of Known Exploited Vulnerabilities","CISA BOD 26-04 – Federal Patching Directive","ISO\u002FIEC 27001:2022 – Control 8.8 Management of Technical Vulnerabilities","ITIL 4 – Change Enablement \u002F Emergency Change Procedures",{}]