CISA Mandates Urgent Patch for Actively Exploited Critical Fortinet Vulnerabilities

CISA warns that two critical FortiSandbox OS command-injection vulnerabilities (CVE-2026-39808 and CVE-2026-25089, CVSS 9.1) have been observed exploited in the wild; both were added to CISA's KEV catalog and Fortinet has released patches (e.g., FortiSandbox 4.4.9 and 5.0.6) with agencies urged to apply mitigations or discontinue cloud services if unable to mitigate.