12OCT

CISA's KEV list runs a month late

2 min read

10:55UTC

CrowdSec flagged live exploitation of Fortinet's FortiSandbox on 17 June; CISA's Known Exploited Vulnerabilities catalogue did not list the flaw until 16 July, a month later.

← Back to China alert puts old bugs on a 3-day clock Jump to analysis ↓

TechnologyAssessed

Key takeaway

CISA catalogued an exploited FortiSandbox flaw a month after CrowdSec detected it in the wild.

CrowdSec logged in-the-wild exploitation of Fortinet's FortiSandbox appliance on 17 June, the same day it shipped a detection rule for CVE-2026-39808, an operating-system command-injection flaw. CISA did not add the bug to its Known Exploited Vulnerabilities (KEV) catalogue until 16 July, a one-month gap⁠¹.

That KEV entry starts the Binding Operational Directive (BOD) 26-04 patching clock for federal agencies. Private detection therefore ran a month ahead of the federal catalogue meant to trigger the mandatory deadline, while CISA works through the FY27 staffing cuts already on this topic's record. CrowdSec is a French crowdsourced threat-intelligence firm, one of several private feeds that now lead the federal list for the defenders who subscribe.

FortiSandbox extends the Fortinet exposure the beat has followed since the FortiBleed credential haul, which SOCRadar tied to Lynx and INC Ransom and later to twelve ransomware deployments. The KEV record still lists the flaw's ransomware association as Unknown, so the crew adopting it has not yet been named.

Deep Analysis

In plain English

FortiSandbox is a security appliance made by Fortinet that scans files for malware. CrowdSec, a French cybersecurity firm, spotted hackers actively exploiting a flaw in it, tracked as CVE-2026-39808, on 17 June. But CISA, the US government's main cybersecurity agency, did not add that flaw to its official list of vulnerabilities under active attack until 16 July, a full month later. That list matters because once a flaw is on it, US federal agencies get a deadline to fix it. Until then, there is no equivalent official deadline forcing anyone to patch.

Deep Analysis

Root Causes

CISA's KEV catalogue depends structurally on either its own confirmation process or third-party reporting reaching the agency, and CrowdSec is a private detection firm with no obligation or guaranteed channel to escalate findings to CISA on any fixed timeline.

CISA's own risk-tiered BOD 26-04, in force since 10 June, only starts its patch-deadline clock once a flaw is added to KEV, so any pre-listing detection lag, like this one, delays the point at which federal agencies face a mandatory remediation deadline.

Escalation

A one-month gap between independent detection and CISA's own KEV listing is a documented delay, though it is not yet established whether this specific gap enabled additional victim compromise beyond what CrowdSec's initial detection covered.

What could happen next?

Consequence
Federal agencies running FortiSandbox had no CISA-mandated patch deadline for a full month after independent researchers confirmed active exploitation.
Risk
A recurring detection-to-listing lag would undercut the risk-tiered deadline model BOD 26-04 introduced on 10 June, since its clock only starts once a flaw reaches KEV.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2023 CitrixBleed vulnerability was actively exploited by ransomware crews for weeks before mass patching caught up, because the gap between confirmed exploitation and organisations treating it as urgent let attackers harvest sessions at scale. FortiSandbox's one-month gap between CrowdSec's detection and CISA's KEV listing follows the same structural pattern: a lag between someone knowing a flaw is being exploited and the mechanism that forces organisations to patch.

Counter-parallel: Unlike CitrixBleed, where exploitation was mass and opportunistic across thousands of victims within weeks, FortiSandbox's gap has not yet been shown to have produced comparable mass compromise, so the KEV lag here may represent process delay rather than an active large-scale attack wave.

Consensus view: CrowdSec, which detected the FortiSandbox exploitation on 17 June, holds that KEV timeliness depends on external telemetry reaching CISA rather than the catalogue's own continuous scanning, since CISA's listing followed CrowdSec's finding by a full month rather than triggering from internal detection.

Counter-view: China's CNCERT has previously argued Western KEV-style catalogues conflate a vendor's confirmed exploitation window with the catalogue's own listing date, understating how long a flaw was actually dangerous before any federal deadline clock started.

Key tension: Whether the one-month gap reflects a reporting delay specific to this flaw or a structural lag in how CISA incorporates third-party detection into the KEV catalogue generally.

Sources:CrowdSec

Mentions:Lynx →INC Ransom →Known Exploited Vulnerabilities →China →FortiBleed →SOCRadar →Binding Operational Directive →CISA →Fortinet →FortiSandbox →CrowdSec →

First Reported In

Update #11 · Zimbra zero-click, and a 15-nation reply

CrowdSec· 24 Jul 2026

Read original →

Causes and effects

Caused by

CISA tears up its KEV deadline rules

CISA's risk-tiered BOD 26-04, issued 10 June, is the directive whose patching clock the FortiSandbox KEV entry starts.

Occurred 10 Jun 2026

Read story →

86,644 Fortinet logins become a hit list

FortiSandbox extends the Fortinet exposure thread that began with the FortiBleed credential haul.

Occurred 18 Jun 2026

Read story →

Lynx crew cashes in FortiBleed haul

SOCRadar's attribution of the FortiGate credential harvest to Lynx and INC Ransom is part of the same Fortinet exposure thread FortiSandbox now extends.

Occurred 1 Jul 2026

Read story →

One operator ran both ransomware brands

The twelve ransomware deployments SOCRadar tied to the FortiBleed haul are the same Fortinet exposure thread the FortiSandbox KEV lag now extends.

Occurred 8 Jul 2026

Read story →

This Event

CISA's KEV list runs a month late

Federal defenders relying on KEV as their exploitation signal trailed private detection by a month on an actively attacked Fortinet flaw.

Different Perspectives

ENISA

ENISA's 22 September threat report found only 23.8 per cent of NoName057(16)'s assessed claims were confirmed by independent availability checks, though the group produced 48 per cent of ideology-driven activity. The agency's numbers show public administration taking 31.8 per cent of attacks, mostly ideological DDoS.

LKA Hamburg

Hamburg's State Criminal Police Office led the operation that took the KillSec leak site on 30 September, with ten countries, Europol and Eurojust. Investigators link the group to around 1,000 suspected attacks, at least 70 in Germany, and the seizure blocks access to at least 110 terabytes of victims' data.

ASOS

ASOS said an unauthorised party reached names and contact details on third-party platforms after obtaining an employee's credentials by impersonating a trusted contact. It said it does not believe payment cards or account passwords were affected, and is investigating.

Check Point

Check Point updated its advisory on 20 September to say its 9.8-rated VPN certificate flaw had been exploited on Spark firewalls since 12 September, five days after the advisory first appeared, and shipped fixes including R81.20 Take 166. It told customers using only pre-shared-key VPN communities they were not exposed.

Japan's National Police Agency

Japan's National Police Agency and National Cybersecurity Office signed advisory AA26-281A and published it on 9 October, naming SoftEther VPN, MicroScan and office-cli and indicators detected since January 2016. Tokyo says the evidence comes from several FBI criminal investigations and that it will deepen cooperation with allies.

CISA

CISA gave federal agencies three days to fix five flaws from 2015 to 2023 on the day the China advisory named Integrity Technology Group, and set the same clock on 34 of 43 September listings. It treats a named state-linked operation as reason enough to patch old software within the week.