3AUG

CISA's KEV list runs a month late

2 min read

16:08UTC

CrowdSec flagged live exploitation of Fortinet's FortiSandbox on 17 June; CISA's Known Exploited Vulnerabilities catalogue did not list the flaw until 16 July, a month later.

← Back to KEV deadlines fell from 14 days to three Jump to analysis ↓

TechnologyAssessed

Key takeaway

CISA catalogued an exploited FortiSandbox flaw a month after CrowdSec detected it in the wild.

CrowdSec logged in-the-wild exploitation of Fortinet's FortiSandbox appliance on 17 June, the same day it shipped a detection rule for CVE-2026-39808, an operating-system command-injection flaw. CISA did not add the bug to its Known Exploited Vulnerabilities (KEV) catalogue until 16 July, a one-month gap ¹.

That KEV entry starts the Binding Operational Directive (BOD) 26-04 patching clock for federal agencies . Private detection therefore ran a month ahead of the federal catalogue meant to trigger the mandatory deadline, while CISA works through the FY27 staffing cuts already on this topic's record. CrowdSec is a French crowdsourced threat-intelligence firm, one of several private feeds that now lead the federal list for the defenders who subscribe.

FortiSandbox extends the Fortinet exposure the beat has followed since the FortiBleed credential haul , which SOCRadar tied to Lynx and INC Ransom and later to twelve ransomware deployments . The KEV record still lists the flaw's ransomware association as Unknown, so the crew adopting it has not yet been named.

Deep Analysis

In plain English

FortiSandbox is a security appliance made by Fortinet that scans files for malware. CrowdSec, a French cybersecurity firm, spotted hackers actively exploiting a flaw in it, tracked as CVE-2026-39808, on 17 June. But CISA, the US government's main cybersecurity agency, did not add that flaw to its official list of vulnerabilities under active attack until 16 July, a full month later. That list matters because once a flaw is on it, US federal agencies get a deadline to fix it. Until then, there is no equivalent official deadline forcing anyone to patch.

Deep Analysis

Root Causes

CISA's KEV catalogue depends structurally on either its own confirmation process or third-party reporting reaching the agency, and CrowdSec is a private detection firm with no obligation or guaranteed channel to escalate findings to CISA on any fixed timeline.

CISA's own risk-tiered BOD 26-04, in force since 10 June, only starts its patch-deadline clock once a flaw is added to KEV, so any pre-listing detection lag, like this one, delays the point at which federal agencies face a mandatory remediation deadline.

Escalation

A one-month gap between independent detection and CISA's own KEV listing is a documented delay, though it is not yet established whether this specific gap enabled additional victim compromise beyond what CrowdSec's initial detection covered.

What could happen next?

Consequence
Federal agencies running FortiSandbox had no CISA-mandated patch deadline for a full month after independent researchers confirmed active exploitation.
Risk
A recurring detection-to-listing lag would undercut the risk-tiered deadline model BOD 26-04 introduced on 10 June, since its clock only starts once a flaw reaches KEV.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2023 CitrixBleed vulnerability was actively exploited by ransomware crews for weeks before mass patching caught up, because the gap between confirmed exploitation and organisations treating it as urgent let attackers harvest sessions at scale. FortiSandbox's one-month gap between CrowdSec's detection and CISA's KEV listing follows the same structural pattern: a lag between someone knowing a flaw is being exploited and the mechanism that forces organisations to patch.

Counter-parallel: Unlike CitrixBleed, where exploitation was mass and opportunistic across thousands of victims within weeks, FortiSandbox's gap has not yet been shown to have produced comparable mass compromise, so the KEV lag here may represent process delay rather than an active large-scale attack wave.

Consensus view: CrowdSec, which detected the FortiSandbox exploitation on 17 June, holds that KEV timeliness depends on external telemetry reaching CISA rather than the catalogue's own continuous scanning, since CISA's listing followed CrowdSec's finding by a full month rather than triggering from internal detection.

Counter-view: China's CNCERT has previously argued Western KEV-style catalogues conflate a vendor's confirmed exploitation window with the catalogue's own listing date, understating how long a flaw was actually dangerous before any federal deadline clock started.

Key tension: Whether the one-month gap reflects a reporting delay specific to this flaw or a structural lag in how CISA incorporates third-party detection into the KEV catalogue generally.

Sources:CrowdSec

Mentions:CrowdStrike →Lynx →INC Ransom →Known Exploited Vulnerabilities →China →FortiBleed →SOCRadar →Binding Operational Directive →CISA →Fortinet →FortiSandbox →CrowdSec →

First Reported In

Update #11 · Zimbra zero-click, and a 15-nation reply

CrowdSec· 24 Jul 2026

Read original →

Causes and effects

Caused by

CISA tears up its KEV deadline rules

CISA's risk-tiered BOD 26-04, issued 10 June, is the directive whose patching clock the FortiSandbox KEV entry starts.

Occurred 10 Jun 2026

Read story →

86,644 Fortinet logins become a hit list

FortiSandbox extends the Fortinet exposure thread that began with the FortiBleed credential haul.

Occurred 18 Jun 2026

Read story →

Lynx crew cashes in FortiBleed haul

SOCRadar's attribution of the FortiGate credential harvest to Lynx and INC Ransom is part of the same Fortinet exposure thread FortiSandbox now extends.

Occurred 1 Jul 2026

Read story →

One operator ran both ransomware brands

The twelve ransomware deployments SOCRadar tied to the FortiBleed haul are the same Fortinet exposure thread the FortiSandbox KEV lag now extends.

Occurred 8 Jul 2026

Read story →

This Event

CISA's KEV list runs a month late

Federal defenders relying on KEV as their exploitation signal trailed private detection by a month on an actively attacked Fortinet flaw.

Different Perspectives

Group-IB

Group-IB, headquartered in Singapore, documented on 19 March that The Gentlemen began inside Qilin's own affiliate programme and split from it over a payment dispute. Its analysis makes this window's leak-site tally readable as a fracture inside one ransomware operation rather than the arrival of an unknown crew.

ENISA

ENISA placed EU drinking water and wastewater in its cyber risk zone for the first time on 28 May, finding one in three water entities had never run a risk assessment. CISA's 30 July advisory to American operators reads as the operational sequel to a gap European regulators had already documented two months earlier.

House of Lords and NCSC

The Cyber Security and Resilience Bill sits at House of Lords committee stage, its amendment paper running to 23 July. Separately, the NCSC guidance CISA cited when directing water operators to disconnect controllers is version 1.0 from March 2024, a two-year-old British document doing operational work in an American alert published last week.

heise online

heise online reported on 27 July that Russian state attackers, named as APT28, ran the hotel WiFi credential-harvesting campaign. Its attribution is firmer than ReliaQuest's own hedged low-to-medium confidence assessment of the same intrusion, a difference in national reporting posture rather than a settled dispute over who is responsible.

CISA and ReliaQuest

CISA compressed remediation deadlines under BOD 26-04 while, in the same window, telling water and wastewater operators to disconnect internet-exposed controllers rather than patch them. ReliaQuest, investigating the hotel WiFi campaign, held its assessment of the intrusion route at low-to-medium confidence and declined to name a state sponsor.

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.