Claims: Attackers target critical FortiSandbox flaws as CISA issues patch order

These are attributed source records, not independent verification of each assertion.

Complete claim record (JSON) · Original source

1. title: Attackers target critical FortiSandbox flaws as CISA issues patch order (alleges; supported) Source
2. url: https://www.theregister.com/security/2026/07/17/attackers-target-critical-fortisandbox-flaws-as-cisa-issues-patch-order/5274287 (alleges; supported) Source
3. summary: Fortinet admins have two more reasons to clear their calendars after CISA confirmed a pair of critical FortiSandbox bugs are being actively exploited. The two bugs, tracked as CVE-2026-39808 and CVE-2026-25089, both carry CVSS scores of 9.1 and affect FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. According to Fortinet, they are OS command injection flaws that allow unauthenticated attackers to execute arbitrary commands via specially crafted HTTP requests, requiring neither valid cred… (alleges; supported) Source
4. published: Fri, 17 Jul 2026 13:58:10 +0200 (alleges; supported) Source