CISA confirmed on July 16, 2026, that two critical command injection flaws in Fortinet's FortiSandbox threat-analysis platform are being actively exploited in real-world attacks. Federal civilian agencies have until Sunday, July 19 to apply vendor patches or pull affected systems offline entirely. What makes the window this narrow is what FortiSandbox actually is: not a web application or a management console, but the appliance that delivers threat verdicts to every other product in an organization's Fortinet security stack — firewalls, email gateways, endpoint agents, SIEMs, and automated response platforms all trust its output. Owning FortiSandbox means forging those verdicts.
The new CISA directive lands against an already alarming backdrop: the FortiBleed campaign, running since at least February 2026, has assembled verified administrator credentials for more than 86,644 internet-facing FortiGate firewalls across 194 countries. Researchers attribute that operation to the Lynx/INC ransomware group, and at least 12 confirmed ransomware deployments have already been traced directly to credentials harvested through it.
