Fortinet in KEV: 2 FortiSandbox RCEs and a Bypass of the FortiOS Anti-Persistence Patch

Three Fortinet vulnerabilities joined the CISA KEV catalog in July 2026: two unauthenticated command injections in FortiSandbox, and one in FortiOS whose significance far exceeds its 5.9 score.

That last one, CVE-2025-68686, is the most instructive of the batch: it isn't a new intrusion flaw, it's a bypass of a patch already released to neutralise a post-exploitation persistence mechanism. In other words, it only affects devices that are already compromised — and its KEV listing signals that this population is far from negligible.

The Three CVEs

FortiSandbox — two unauthenticated command injections

CVE-2026-39808

The NVD description deserves quoting verbatim:

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

The placeholder was never filled in. The advisory shipped with the template intact, leaving defenders with no indication of the attack vector. It changes nothing about what to do — patch — but it complicates detection: you can't build a targeted IDS rule without knowing which endpoint is hit.

CVE-2026-25089

NVD hasn't published a score or vector yet. The CISA description, however, is more useful than the previous one's:

Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.

Note the scope includes the Cloud and PaaS variants, not just the appliance. If you consume FortiSandbox as a managed service, check your tenant's status with Fortinet.

Why a compromised sandbox is a particular problem

FortiSandbox is the behavioural analysis component of the Fortinet ecosystem: suspicious files intercepted by FortiGate, FortiMail and FortiWeb are sent there for detonation.

An attacker gaining code execution on the sandbox therefore gains three things:

1. Detection neutralisation — they can have their own payloads verdicted "clean", clearing the way for whatever they want to push through the FortiGates next
2. Access to every analysed sample, i.e. a slice of the attachments and files exchanged across the organisation
3. A privileged network position — the sandbox talks to every security device in the estate and sits on the management network

This is the paradox of security appliances: the more central they are to detection, the quieter their compromise.

FortiOS CVE-2025-68686 — the bypass that matters

The context you need to understand it

NVD description:

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

Let's unpack that. A persistence mechanism was observed in the field: after compromising a FortiGate through some other flaw, attackers planted a symbolic link in the directory tree served by the SSL-VPN web portal. That symlink exposed the appliance filesystem for reading — including configuration files — without authentication, and survived updates because it wasn't a modified binary but a plain link in a data area.

Fortinet released a patch to neutralise that mechanism. CVE-2025-68686 bypasses that patch.

What this means in practice

The prerequisite — having already compromised the device — explains the AC:H and the moderate 5.9 score. In isolation, it looks like a second-tier CVE.

Its KEV listing says precisely the opposite. It means the population of already-compromised FortiOS devices is large enough, and the mechanism actively exploited enough, for CISA to mandate remediation.

That's the takeaway, and it generalises beyond Fortinet: a patch applied after a compromise does not restore the device's integrity. If a FortiGate in your estate was compromised at any point in recent years — a period during which several FortiOS CVEs were mass-exploited — the patch alone isn't enough. You have to hunt the persistence.

Versions

Branches 7.2, 7.0 and 6.4 are affected in their entirety — there is no fixed release in those branches, only migration.

Detection and IOCs

Hunt for the FortiOS persistence symlink

This is the single most important check in this article, and it's valid regardless of your installed version.

From the FortiGate CLI, inspect the contents of the SSL-VPN portal language file directories — the historically abused location:

diagnose sys last-modified-files

Then, with deeper diagnostic access, search for symbolic links in the tree served by the portal. Any symlink pointing at / or at a configuration directory is a compromise artefact, never a legitimate element.

Signs of prior FortiGate compromise

Since this CVE only affects already-compromised devices, the real question is: were they?

• Unknown administrator accounts, or SSL-VPN local accounts your teams didn't create
• Configuration containing undocumented routes, rules or objects
• VPN tunnels configured to unknown destinations
• Cleared logs or unexplained gaps in the SIEM feed
• Outbound traffic from the appliance itself to non-Fortinet destinations

FortiSandbox

The unfilled placeholder in the CVE-2026-39808 advisory rules out targeted detection. Fall back on fundamentals:

• HTTP requests to the FortiSandbox admin interface from non-management sources
• Unexpected child processes on the appliance
• Outbound connections from the sandbox to destinations outside Fortinet and outside your telemetry
• Abnormally clean verdicts on samples other engines flag — a possible sign of tampering

Mitigation and Patch

1. FortiSandbox — patch to 4.4.9

Two unauthenticated RCEs on the same product, with the CISA deadline already passed. High priority. If you use the Cloud or PaaS variants, confirm your tenant's status with Fortinet.

2. FortiOS — patch, then hunt

For the 7.4 and 7.6 branches, move to 7.4.7 or 7.6.2. For 7.2, 7.0 and 6.4, plan a migration: they're affected in full and, more broadly, shouldn't still be in production.

Then, independently of the patch, run the persistence hunt described above. It's the one part of this article that an update cannot resolve.

3. Reduce interface exposure

Neither appliance should expose its admin interface to the internet:

# FortiGate — restrict admin access to management networks
config system interface
    edit "port1"
        set allowaccess ping
    next
end

config system admin
    edit "admin"
        set trusthost1 <management-cidr>
    next
end

FortiGate's trusthost is the equivalent of Check Point's Trusted Clients: an immediate, free, effective mitigation against an entire class of CVEs — present and future.

4. If you conclude there was a compromise

1. Don't just patch. On a network device compromised at filesystem level, wiping and rebuilding from an audited reference configuration is the only reliable approach
2. Rotate every secret the device holds: admin passwords, IPsec PSKs, certificates, RADIUS/LDAP credentials, SAML secrets
3. Treat SSL-VPN user credentials as exposed and trigger a rotation
4. Audit what transited: a compromised FortiGate may have decrypted inspected traffic

Why Continuous Monitoring of Security Appliances Matters

Security appliances embody an awkward contradiction: they're front-line exposed by functional necessity, they hold the network's most sensitive secrets, and they're the worst covered by vulnerability inventories — no agent, no presence in OS scans, and advisories published on authenticated vendor portals.

CVE-2025-68686 adds a dimension: it's a reminder that a 5.9 CVE can be more urgent than a 9.8 one depending on your estate's history. No score models that.

With cveo.tech, inventory your FortiGate, FortiSandbox and other security appliances and get automatic alerts whenever a CVE targets one of your exact versions — with CISA KEV status surfaced, because on this device class the gap between "theoretical" and "exploited" is measured in days.