Actively exploited
Listed in CISA’s Known Exploited Vulnerabilities catalog since July 16, 2026.
CVE-2026-25089
Fortinet FortiSandbox OS Command Injection Vulnerability
Fortinet · FortiSandbox
Published July 21, 2026
What happened
Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
What it means for your business
Fortinet FortiSandbox is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-25089). Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. CISA remediation due date: 2026-07-19. PremierePC tracks KEV alerts for Upstate SC businesses — patch or open a ticket if you need help verifying exposure.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date: July 19, 2026
Sources
Related briefs
CVE-2026-39808
Fortinet FortiSandbox OS Command Injection Vulnerability
Fortinet FortiSandbox is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-39808). Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. CISA remediation due date: 2026-07-19. PremierePC tracks KEV alerts for Upstate SC businesses — patch or open a ticket if you need help verifying exposure.
CVE-2021-27137
DD-WRT Stack-Based Buffer Overflow Vulnerability
DD-WRT DD-WRT is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2021-27137). DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability. CISA remediation due date: 2026-07-24. PremierePC tracks KEV alerts for Upstate SC businesses — patch or open a ticket if you need help verifying exposure.
CVE-2023-4346
KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability
KNX Association KNX Protocol Connection Authorization Option 1 is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2023-4346). KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device. CISA remediation due date: 2026-07-29. PremierePC tracks KEV alerts for Upstate SC businesses — patch or open a ticket if you need help verifying exposure.
CVE-2025-67038
Lantronix EDS5000 Code Injection Vulnerability
Lantronix EDS5000 is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2025-67038). Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges. CISA remediation due date: 2026-06-26. PremierePC tracks KEV alerts for Upstate SC businesses — patch or open a ticket if you need help verifying exposure.
Need help patching?
PremierePC monitors KEV alerts for managed clients and helps teams prioritize remediation before attackers do.