
CrowdSec
French Open-source, crowdsourced cyber threat-intelligence and collaborative detection firm.
CrowdSec's sensor network recorded CVE-2026-39808 being used against FortiSandbox on 17 June 2026, 29 days before CISA placed the vulnerability in its federal exploited-flaw catalogue.
Last refreshed: 22 October 2026 · Appears in 1 active topic
Timeline for CrowdSec
Mentioned in: Atlassian bug hit hours after a write-up
Cybersecurity: Threats and DefencesMentioned in: KEV patch clocks fell to three days
Cybersecurity: Threats and DefencesMentioned in: Arista, Fortinet and Cisco flaws listed
Cybersecurity: Threats and DefencesDetected in-the-wild exploitation of FortiSandbox on 17 June, a month before the KEV listing
Cybersecurity: Threats and Defences: CISA's KEV list runs a month lateBackground
CrowdSec is a French cyber threat-intelligence company built around open-source security software and shared detection data. Its software lets participating organisations identify hostile behaviour on their own systems and contribute attack signals to a common network. CrowdSec aggregates those observations into reputation and threat data that other participants can use.
The collaborative model draws on telemetry from organisations that range from individual server operators to larger networks. It can surface repeated attack patterns without waiting for every participant to maintain a separate threat-intelligence team. Because the signals come from observed traffic, the network may identify exploitation before a vendor or government agency publishes an advisory. CrowdSec does not itself set mandatory patch deadlines.
CrowdSec spots attacks before federal listing
On 17 June 2026, CrowdSec's shared telemetry caught live attacks using CVE-2026-39808 against FortiSandbox. The vulnerability entered CISA's Known Exploited Vulnerabilities catalogue on 16 July. CrowdSec had recorded the exploitation 29 days before the federal listing.
The gap demonstrated the value and limit of CrowdSec's crowdsourced model. Its network telemetry could warn defenders before a government catalogue added an entry, but CrowdSec could not start the federal remediation clock. For organisations that used KEV entry alone as their patch trigger, the public deadline arrived only after attackers were already active. CrowdSec's signal therefore complemented the official catalogue rather than replacing its authority.
What is CrowdSec?
How much earlier did CrowdSec detect the FortiSandbox flaw than CISA?
Why does CrowdSec sometimes detect exploitation before CISA's KEV catalogue?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.