24JUL

CISA's KEV list runs a month late

2 min read

18:20UTC

CrowdSec flagged live exploitation of Fortinet's FortiSandbox on 17 June; CISA's Known Exploited Vulnerabilities catalogue did not list the flaw until 16 July, a month later.

← Back to Zimbra zero-click, and a 15-nation reply Jump to analysis ↓

TechnologyAssessed

Key takeaway

CISA catalogued an exploited FortiSandbox flaw a month after CrowdSec detected it in the wild.

CrowdSec logged in-the-wild exploitation of Fortinet's FortiSandbox appliance on 17 June, the same day it shipped a detection rule for CVE-2026-39808, an operating-system command-injection flaw. CISA did not add the bug to its Known Exploited Vulnerabilities (KEV) catalogue until 16 July, a one-month gap ¹.

That KEV entry starts the Binding Operational Directive (BOD) 26-04 patching clock for federal agencies . Private detection therefore ran a month ahead of the federal catalogue meant to trigger the mandatory deadline, while CISA works through the FY27 staffing cuts already on this topic's record. CrowdSec is a French crowdsourced threat-intelligence firm, one of several private feeds that now lead the federal list for the defenders who subscribe.

FortiSandbox extends the Fortinet exposure the beat has followed since the FortiBleed credential haul , which SOCRadar tied to Lynx and INC Ransom and later to twelve ransomware deployments . The KEV record still lists the flaw's ransomware association as Unknown, so the crew adopting it has not yet been named.

Deep Analysis

In plain English

FortiSandbox is a security appliance made by Fortinet that scans files for malware. CrowdSec, a French cybersecurity firm, spotted hackers actively exploiting a flaw in it, tracked as CVE-2026-39808, on 17 June. But CISA, the US government's main cybersecurity agency, did not add that flaw to its official list of vulnerabilities under active attack until 16 July, a full month later. That list matters because once a flaw is on it, US federal agencies get a deadline to fix it. Until then, there is no equivalent official deadline forcing anyone to patch.

Deep Analysis

Root Causes

CISA's KEV catalogue depends structurally on either its own confirmation process or third-party reporting reaching the agency, and CrowdSec is a private detection firm with no obligation or guaranteed channel to escalate findings to CISA on any fixed timeline.

CISA's own risk-tiered BOD 26-04, in force since 10 June, only starts its patch-deadline clock once a flaw is added to KEV, so any pre-listing detection lag, like this one, delays the point at which federal agencies face a mandatory remediation deadline.

Escalation

A one-month gap between independent detection and CISA's own KEV listing is a documented delay, though it is not yet established whether this specific gap enabled additional victim compromise beyond what CrowdSec's initial detection covered.

What could happen next?

Consequence
Federal agencies running FortiSandbox had no CISA-mandated patch deadline for a full month after independent researchers confirmed active exploitation.
Risk
A recurring detection-to-listing lag would undercut the risk-tiered deadline model BOD 26-04 introduced on 10 June, since its clock only starts once a flaw reaches KEV.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2023 CitrixBleed vulnerability was actively exploited by ransomware crews for weeks before mass patching caught up, because the gap between confirmed exploitation and organisations treating it as urgent let attackers harvest sessions at scale. FortiSandbox's one-month gap between CrowdSec's detection and CISA's KEV listing follows the same structural pattern: a lag between someone knowing a flaw is being exploited and the mechanism that forces organisations to patch.

Counter-parallel: Unlike CitrixBleed, where exploitation was mass and opportunistic across thousands of victims within weeks, FortiSandbox's gap has not yet been shown to have produced comparable mass compromise, so the KEV lag here may represent process delay rather than an active large-scale attack wave.

Consensus view: CrowdSec, which detected the FortiSandbox exploitation on 17 June, holds that KEV timeliness depends on external telemetry reaching CISA rather than the catalogue's own continuous scanning, since CISA's listing followed CrowdSec's finding by a full month rather than triggering from internal detection.

Counter-view: China's CNCERT has previously argued Western KEV-style catalogues conflate a vendor's confirmed exploitation window with the catalogue's own listing date, understating how long a flaw was actually dangerous before any federal deadline clock started.

Key tension: Whether the one-month gap reflects a reporting delay specific to this flaw or a structural lag in how CISA incorporates third-party detection into the KEV catalogue generally.

Sources:CrowdSec

Mentions:CrowdStrike →Fortinet →CISA →Lynx →INC Ransom →Known Exploited Vulnerabilities →China →FortiBleed →SOCRadar →

First Reported In

Update #11 · Zimbra zero-click, and a 15-nation reply

CrowdSec· 24 Jul 2026

Read original →

Causes and effects

Caused by

CISA tears up its KEV deadline rules

CISA's risk-tiered BOD 26-04, issued 10 June, is the directive whose patching clock the FortiSandbox KEV entry starts.

Occurred 10 Jun 2026

Read story →

86,644 Fortinet logins become a hit list

FortiSandbox extends the Fortinet exposure thread that began with the FortiBleed credential haul.

Occurred 18 Jun 2026

Read story →

Lynx crew cashes in FortiBleed haul

SOCRadar's attribution of the FortiGate credential harvest to Lynx and INC Ransom is part of the same Fortinet exposure thread FortiSandbox now extends.

Occurred 1 Jul 2026

Read story →

One operator ran both ransomware brands

The twelve ransomware deployments SOCRadar tied to the FortiBleed haul are the same Fortinet exposure thread the FortiSandbox KEV lag now extends.

Occurred 8 Jul 2026

Read story →

This Event

CISA's KEV list runs a month late

Federal defenders relying on KEV as their exploitation signal trailed private detection by a month on an actively attacked Fortinet flaw.

Different Perspectives

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.

CNCERT

China's national CERT was not party to AA26-204A and has previously argued that Western KEV-based advisories conflate demonstrated exploit capability with confirmed breach impact. It is expected to treat this fortnight's coalition-based Russia attribution as a Five Eyes-led exercise rather than an independently verified finding.

Russia

Moscow has not publicly responded to the AA26-204A attribution naming LAUNDRY BEAR as a Russian state-supported actor behind the Zimbra zero-click chain. Russian officials have consistently denied state involvement in prior Western cyber-attribution advisories, a pattern this fifteen-agency coalition is likely to meet with the same denial.

National Crime Agency

The NCA called the Woolwich Crown Court sentencing of Owen Flowers and Thalha Jubair Britain's largest-ever cybercrime prosecution. It expects continued pressure on Scattered Spider's UK-linked membership, alongside City of London Police's push for statutory Cyber Crime Risk Orders.

CISA

CISA co-led AA26-204A naming LAUNDRY BEAR and added five more flaws to KEV this fortnight, including a three-day Oracle EBS deadline, while absorbing a one-month detection-to-listing gap on FortiSandbox. It expects the risk-tiered BOD 26-04 model to hold even as a proposed $707m FY27 cut threatens the staffing behind it.

UK managed service providers and data centre operators

Newly brought into critical-infrastructure scope by the Cyber Security and Resilience Bill's Lords second reading, facing fines up to £17m or 4% of global turnover and a new near-miss reporting duty they did not previously carry. The sector moves from best-practice guidance to statutory exposure within this Parliamentary session.