CISA confirms active exploitation of two Critical FortiSandbox command-injection vulnerabilities

What changed

Finding 01 elevates CVE-2026-25089 and CVE-2026-39808 after CISA listed both FortiSandbox command-injection vulnerabilities as known exploited, with CVE-specific evidence confirming exploitation. Finding 02 identifies CVE-2026-54567 as an incomplete-fix variant of CVE-2026-27641 in Flask-Reuploaded's name-override path, while Finding 03 identifies CVE-2026-54076 as an incomplete fix of CVE-2026-44221 affecting ArcadeDB schema controls.

Finding 04 introduces CVE-2026-49445, which exposes an Envoy administrative socket on affected Cilium nodes when L7 functionality is enabled. Finding 05 highlights CVE-2026-55579 and Pheditor's hardcoded default administrator password. Finding 06 records an available remediation for CVE-2026-50197, an incomplete Skipper fix that can allow oversized request bodies to bypass relevant OPA policies.

Finding 07 adds CVE-2026-45576, through which zrok2 copy can write outside its selected local destination. Finding 08 adds CVE-2026-56742 for cross-namespace Cilium Gateway API route mirroring. Finding 09 adds CVE-2026-61863, a small ImageMagick TIFF encoder memory leak when temporary-file creation fails.

Finding 10 records public reporting of CVE-2026-63030 as an unauthenticated WordPress Core remote-code-execution vulnerability and retains CVE-2026-60137 as the associated SQL-injection issue. Finding 11 identifies CVE-2026-49981 in Twig, where an allow-list verdict can remain cached after sandbox state changes.

Finding 12 reports Daxin alongside the Stupig pre-login SYSTEM backdoor at a Taiwan manufacturer. Finding 13 reports seven malicious npm packages targeting Vite developers and using blockchain-based command and control to deliver a remote-access trojan. Finding 14 records Risk Ledger's $32 million Series B as a supplier-security market development. Finding 15 highlights HollowByte, for which an 11-byte TLS request can strand memory on tested glibc systems despite the absence of a CVE or public OpenSSL advisory.

Why it matters

Finding 01 requires immediate attention because exploitation is confirmed separately for CVE-2026-25089 and CVE-2026-39808. Findings 02, 03 and 06 also show why organisations should validate the effectiveness of earlier fixes rather than treating their installation as proof that the original security boundary now holds.

Findings 04 and 08 both concern Cilium, but they require separate scoping: CVE-2026-49445 depends on L7 functionality and local node access, whereas CVE-2026-56742 concerns namespaced HTTPRoute permissions and cross-namespace service mirroring. Their exposure conditions must not be combined.

Findings 05, 07, 10 and 11 affect distinct trust boundaries: default administrative credentials, local destination paths, WordPress request handling and Twig sandbox policy. Finding 09 is narrower, describing a small memory leak rather than evidence of code execution. Findings 12, 13 and 15 warrant threat-hunting or exposure review outside conventional CVE-only queues, while Finding 14 is a market signal rather than an intrusion or vulnerability.

• Recommended actions
• FortiSandbox owner: For Finding 01, identify assets potentially affected by CVE-2026-25089 or CVE-2026-39808, apply the mitigations in the linked vendor instructions, and follow CISA's applicable prioritisation and forensic-triage guidance.
• Flask-Reuploaded owner: For Finding 02, identify use of CVE-2026-27641-affected code and the CVE-2026-54567 incomplete-fix variant, apply the remediation referenced by the linked advisory, and test mixed-case denied extensions through the name-override path.
• ArcadeDB owner: For Finding 03, inventory deployments relevant to CVE-2026-44221 and CVE-2026-54076, consult the linked advisory for current remediation guidance, and verify that read-only users cannot mutate schema state.
• Cilium platform owner: For Finding 04, identify clusters running versions affected by CVE-2026-49445 with L7 functionality enabled, restrict local node access, and verify remediation against the linked NVD entry.
• Pheditor owner: For Finding 05, locate reachable CVE-2026-55579 deployments, replace the default admin credential, restrict application access, and review the linked advisory for further guidance.
• Skipper and OPA owner: For Finding 06, apply the available CVE-2026-50197 remediation from the linked advisory and test deny-on-presence policies with oversized request bodies.
• zrok owner: For Finding 07, identify CVE-2026-45576 exposure in zrok2 copy workflows using untrusted WebDAV or zrok-drive paths, verify version 2.0.3 guidance, and test that writes remain inside the selected destination root.
• Cilium Gateway API owner: For Finding 08, identify CVE-2026-56742 exposure among users permitted to create or update namespaced HTTPRoutes, verify current guidance, and test that route mirroring cannot target unauthorised services in other namespaces.
• Image-processing owner: For Finding 09, inventory ImageMagick versions relevant to CVE-2026-61863 and verify the TIFF encoder behaviour and applicable version guidance in the linked NVD entry.
• WordPress owner: For Finding 10, identify WordPress Core instances potentially affected by CVE-2026-63030 and the associated CVE-2026-60137 SQL-injection issue, then follow the linked research and advisory references for version-specific remediation.
• Twig application owner: For Finding 11, locate CVE-2026-49981 exposure in Twig versions before 3.27.0, review applications that change sandbox policy between renders, and verify remediation through the linked NVD entry.
• Threat-hunting lead: For Finding 12, review the linked Daxin and Stupig report and hunt Windows systems for relevant pre-sign-in execution through the logon process, without assuming the reported Taiwan exposure extends to other environments.
• Software supply-chain owner: For Finding 13, compare Vite-related npm dependencies with the seven malicious packages named in the linked report and investigate matching blockchain command-and-control or remote-access-trojan indicators on developer systems.
• Third-party risk owner: For Finding 14, treat Risk Ledger's funding as a supplier-security market development, and assess any resulting product or procurement implications separately from incident-response priorities.
• TLS service owner: For Finding 15, do not rely solely on CVE-based scanning; use the linked HollowByte research to identify potentially affected OpenSSL branches and test memory behaviour on relevant glibc-hosted services.

Evidence limits

Finding 01 has confirmed exploitation for CVE-2026-25089 and CVE-2026-39808, but its fixed-version or patch state is not established. Finding 02 has an available remediation, but exploitation is not confirmed. Findings 03, 04 and 05 lack confirmed exploitation, and their current patch states are not established.

Finding 06 has an available remediation but no confirmed exploitation. Findings 07, 08 and 09 have no confirmed exploitation, while their current patch states remain unconfirmed despite source or CVE-level references to fixes.

Finding 10 has no assigned public severity because the available evidence does not resolve the CVE-level conflicts, and exploitation is not confirmed. Finding 11 likewise has no assigned public severity; its source describes a higher severity than the narrower technical assessment, exploitation is not confirmed, and the current patch state is not established.

Findings 12, 13, 14 and 15 have no grounded public severity, and their exploitation and remediation states are unknown. Finding 12 reflects one reported Taiwan manufacturing environment, Finding 13 does not establish exposure beyond the reported malicious packages, Finding 14 is not an exploit report, and Finding 15 lacks a CVE and public OpenSSL advisory.