CISA urges immediate action on actively exploited Fortinet flaws

CISA ordered U.S. federal agencies to urgently prioritize patching two critical Fortinet FortiSandbox vulnerabilities (CVE-2026-39808 and CVE-2026-25089) that allow unauthenticated remote command injection and have been observed exploited in the wild; Fortinet released patches on April 14 and June 9 and agencies must remediate by July 19 under BOD 26-04. Threat intelligence firm Defused reported active exploitation, and the advisory references other Fortinet flaws previously abused in espionage and ransomware campaigns.