5SEP

CISA's KEV list runs a month late

2 min read

12:09UTC

CrowdSec flagged live exploitation of Fortinet's FortiSandbox on 17 June; CISA's Known Exploited Vulnerabilities catalogue did not list the flaw until 16 July, a month later.

← Back to Four privileged platforms under live attack Jump to analysis ↓

TechnologyAssessed

Key takeaway

CISA catalogued an exploited FortiSandbox flaw a month after CrowdSec detected it in the wild.

CrowdSec logged in-the-wild exploitation of Fortinet's FortiSandbox appliance on 17 June, the same day it shipped a detection rule for CVE-2026-39808, an operating-system command-injection flaw. CISA did not add the bug to its Known Exploited Vulnerabilities (KEV) catalogue until 16 July, a one-month gap ¹.

That KEV entry starts the Binding Operational Directive (BOD) 26-04 patching clock for federal agencies . Private detection therefore ran a month ahead of the federal catalogue meant to trigger the mandatory deadline, while CISA works through the FY27 staffing cuts already on this topic's record. CrowdSec is a French crowdsourced threat-intelligence firm, one of several private feeds that now lead the federal list for the defenders who subscribe.

FortiSandbox extends the Fortinet exposure the beat has followed since the FortiBleed credential haul , which SOCRadar tied to Lynx and INC Ransom and later to twelve ransomware deployments . The KEV record still lists the flaw's ransomware association as Unknown, so the crew adopting it has not yet been named.

Deep Analysis

In plain English

FortiSandbox is a security appliance made by Fortinet that scans files for malware. CrowdSec, a French cybersecurity firm, spotted hackers actively exploiting a flaw in it, tracked as CVE-2026-39808, on 17 June. But CISA, the US government's main cybersecurity agency, did not add that flaw to its official list of vulnerabilities under active attack until 16 July, a full month later. That list matters because once a flaw is on it, US federal agencies get a deadline to fix it. Until then, there is no equivalent official deadline forcing anyone to patch.

Deep Analysis

Root Causes

CISA's KEV catalogue depends structurally on either its own confirmation process or third-party reporting reaching the agency, and CrowdSec is a private detection firm with no obligation or guaranteed channel to escalate findings to CISA on any fixed timeline.

CISA's own risk-tiered BOD 26-04, in force since 10 June, only starts its patch-deadline clock once a flaw is added to KEV, so any pre-listing detection lag, like this one, delays the point at which federal agencies face a mandatory remediation deadline.

Escalation

A one-month gap between independent detection and CISA's own KEV listing is a documented delay, though it is not yet established whether this specific gap enabled additional victim compromise beyond what CrowdSec's initial detection covered.

What could happen next?

Consequence
Federal agencies running FortiSandbox had no CISA-mandated patch deadline for a full month after independent researchers confirmed active exploitation.
Risk
A recurring detection-to-listing lag would undercut the risk-tiered deadline model BOD 26-04 introduced on 10 June, since its clock only starts once a flaw reaches KEV.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2023 CitrixBleed vulnerability was actively exploited by ransomware crews for weeks before mass patching caught up, because the gap between confirmed exploitation and organisations treating it as urgent let attackers harvest sessions at scale. FortiSandbox's one-month gap between CrowdSec's detection and CISA's KEV listing follows the same structural pattern: a lag between someone knowing a flaw is being exploited and the mechanism that forces organisations to patch.

Counter-parallel: Unlike CitrixBleed, where exploitation was mass and opportunistic across thousands of victims within weeks, FortiSandbox's gap has not yet been shown to have produced comparable mass compromise, so the KEV lag here may represent process delay rather than an active large-scale attack wave.

Consensus view: CrowdSec, which detected the FortiSandbox exploitation on 17 June, holds that KEV timeliness depends on external telemetry reaching CISA rather than the catalogue's own continuous scanning, since CISA's listing followed CrowdSec's finding by a full month rather than triggering from internal detection.

Counter-view: China's CNCERT has previously argued Western KEV-style catalogues conflate a vendor's confirmed exploitation window with the catalogue's own listing date, understating how long a flaw was actually dangerous before any federal deadline clock started.

Key tension: Whether the one-month gap reflects a reporting delay specific to this flaw or a structural lag in how CISA incorporates third-party detection into the KEV catalogue generally.

Sources:CrowdSec

Mentions:CrowdStrike →Lynx →INC Ransom →Known Exploited Vulnerabilities →China →FortiBleed →SOCRadar →Binding Operational Directive →CISA →Fortinet →FortiSandbox →CrowdSec →

First Reported In

Update #11 · Zimbra zero-click, and a 15-nation reply

CrowdSec· 24 Jul 2026

Read original →

Causes and effects

Caused by

CISA tears up its KEV deadline rules

CISA's risk-tiered BOD 26-04, issued 10 June, is the directive whose patching clock the FortiSandbox KEV entry starts.

Occurred 10 Jun 2026

Read story →

86,644 Fortinet logins become a hit list

FortiSandbox extends the Fortinet exposure thread that began with the FortiBleed credential haul.

Occurred 18 Jun 2026

Read story →

Lynx crew cashes in FortiBleed haul

SOCRadar's attribution of the FortiGate credential harvest to Lynx and INC Ransom is part of the same Fortinet exposure thread FortiSandbox now extends.

Occurred 1 Jul 2026

Read story →

One operator ran both ransomware brands

The twelve ransomware deployments SOCRadar tied to the FortiBleed haul are the same Fortinet exposure thread the FortiSandbox KEV lag now extends.

Occurred 8 Jul 2026

Read story →

This Event

CISA's KEV list runs a month late

Federal defenders relying on KEV as their exploitation signal trailed private detection by a month on an actively attacked Fortinet flaw.

Different Perspectives

ENISA

ENISA published an SME cyber-resilience maturity model on 6 August and updated the Cyber Resilience Act reporting-platform FAQ on 31 August. The agency supplies common implementation tools for smaller operators, but it cannot fine organisations that do not use them.

UAE Cyber Security Council

On 10 August, the UAE Cyber Security Council said national teams contained attacks on aviation, energy and education before objectives were reached. Its second monthly statement, after a 3 July financial-sector disclosure, makes public reporting of stopped attacks part of its operating posture.

South African authorities

INTERPOL said on 25 August that South African authorities made 39 arrests, seized US$2.67 million and blocked 257 accounts during Operation Jackal IV. Their share of the 23-country operation shows the material enforcement burden in a cross-border fraud case.

Europol

On 2 September, Europol announced the sinkholing of Sality after a 31 August operation involving US, Bulgarian, Hungarian and Romanian authorities. Its more than 11 million linked IP addresses measure infrastructure contact, not confirmed victims, and show why technical partners joined the action.

CISA

From 3 August to 2 September, CISA recorded three-day deadlines for 24 of 37 KEV additions, compared with 34 of 39 from 10 June to 29 July. The falling share changes the urgency signal that US federal agencies and private-sector tooling draw from the catalogue.

Beacon

On 3 September, Beacon said its final report found that an intruder likely exported its customer database during roughly one hour and 27 minutes on 27 July. Charities using the CRM now have a named exposure route, a compromised AWS access key in public build artefacts.