22OCT

CISA's KEV list runs a month late

2 min read

16:31UTC

CrowdSec flagged live exploitation of Fortinet's FortiSandbox on 17 June; CISA's Known Exploited Vulnerabilities catalogue did not list the flaw until 16 July, a month later.

← Back to Fridge hack spoils food in seven countries Jump to analysis ↓

TechnologyAssessed

Key takeaway

CISA catalogued an exploited FortiSandbox flaw a month after CrowdSec detected it in the wild.

CrowdSec logged in-the-wild exploitation of Fortinet's FortiSandbox appliance on 17 June, the same day it shipped a detection rule for CVE-2026-39808, an operating-system command-injection flaw. CISA did not add the bug to its Known Exploited Vulnerabilities (KEV) catalogue until 16 July, a one-month gap⁠¹.

That KEV entry starts the Binding Operational Directive (BOD) 26-04 patching clock for federal agencies. Private detection therefore ran a month ahead of the federal catalogue meant to trigger the mandatory deadline, while CISA works through the FY27 staffing cuts already on this topic's record. CrowdSec is a French crowdsourced threat-intelligence firm, one of several private feeds that now lead the federal list for the defenders who subscribe.

FortiSandbox extends the Fortinet exposure the beat has followed since the FortiBleed credential haul, which SOCRadar tied to Lynx and INC Ransom and later to twelve ransomware deployments. The KEV record still lists the flaw's ransomware association as Unknown, so the crew adopting it has not yet been named.

Deep Analysis

In plain English

FortiSandbox is a security appliance made by Fortinet that scans files for malware. CrowdSec, a French cybersecurity firm, spotted hackers actively exploiting a flaw in it, tracked as CVE-2026-39808, on 17 June. But CISA, the US government's main cybersecurity agency, did not add that flaw to its official list of vulnerabilities under active attack until 16 July, a full month later. That list matters because once a flaw is on it, US federal agencies get a deadline to fix it. Until then, there is no equivalent official deadline forcing anyone to patch.

Deep Analysis

Root Causes

CISA's KEV catalogue depends structurally on either its own confirmation process or third-party reporting reaching the agency, and CrowdSec is a private detection firm with no obligation or guaranteed channel to escalate findings to CISA on any fixed timeline.

CISA's own risk-tiered BOD 26-04, in force since 10 June, only starts its patch-deadline clock once a flaw is added to KEV, so any pre-listing detection lag, like this one, delays the point at which federal agencies face a mandatory remediation deadline.

Escalation

A one-month gap between independent detection and CISA's own KEV listing is a documented delay, though it is not yet established whether this specific gap enabled additional victim compromise beyond what CrowdSec's initial detection covered.

What could happen next?

Consequence
Federal agencies running FortiSandbox had no CISA-mandated patch deadline for a full month after independent researchers confirmed active exploitation.
Risk
A recurring detection-to-listing lag would undercut the risk-tiered deadline model BOD 26-04 introduced on 10 June, since its clock only starts once a flaw reaches KEV.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2023 CitrixBleed vulnerability was actively exploited by ransomware crews for weeks before mass patching caught up, because the gap between confirmed exploitation and organisations treating it as urgent let attackers harvest sessions at scale. FortiSandbox's one-month gap between CrowdSec's detection and CISA's KEV listing follows the same structural pattern: a lag between someone knowing a flaw is being exploited and the mechanism that forces organisations to patch.

Counter-parallel: Unlike CitrixBleed, where exploitation was mass and opportunistic across thousands of victims within weeks, FortiSandbox's gap has not yet been shown to have produced comparable mass compromise, so the KEV lag here may represent process delay rather than an active large-scale attack wave.

Consensus view: CrowdSec, which detected the FortiSandbox exploitation on 17 June, holds that KEV timeliness depends on external telemetry reaching CISA rather than the catalogue's own continuous scanning, since CISA's listing followed CrowdSec's finding by a full month rather than triggering from internal detection.

Counter-view: China's CNCERT has previously argued Western KEV-style catalogues conflate a vendor's confirmed exploitation window with the catalogue's own listing date, understating how long a flaw was actually dangerous before any federal deadline clock started.

Key tension: Whether the one-month gap reflects a reporting delay specific to this flaw or a structural lag in how CISA incorporates third-party detection into the KEV catalogue generally.

Sources:CrowdSec

Mentions:Lynx →INC Ransom →Known Exploited Vulnerabilities →China →FortiBleed →SOCRadar →Binding Operational Directive →CISA →Fortinet →FortiSandbox →CrowdSec →

First Reported In

Update #11 · Zimbra zero-click, and a 15-nation reply

CrowdSec· 24 Jul 2026

Read original →

Causes and effects

Caused by

CISA tears up its KEV deadline rules

CISA's risk-tiered BOD 26-04, issued 10 June, is the directive whose patching clock the FortiSandbox KEV entry starts.

Occurred 10 Jun 2026

Read story →

86,644 Fortinet logins become a hit list

FortiSandbox extends the Fortinet exposure thread that began with the FortiBleed credential haul.

Occurred 18 Jun 2026

Read story →

Lynx crew cashes in FortiBleed haul

SOCRadar's attribution of the FortiGate credential harvest to Lynx and INC Ransom is part of the same Fortinet exposure thread FortiSandbox now extends.

Occurred 1 Jul 2026

Read story →

One operator ran both ransomware brands

The twelve ransomware deployments SOCRadar tied to the FortiBleed haul are the same Fortinet exposure thread the FortiSandbox KEV lag now extends.

Occurred 8 Jul 2026

Read story →

This Event

CISA's KEV list runs a month late

Federal defenders relying on KEV as their exploitation signal trailed private detection by a month on an actively attacked Fortinet flaw.

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.