Fortinet: 2 Actively-Exploited Flaws Added to CISA KEV
CISA has added two Fortinet vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming they are under active exploitation in the wild and requiring urgent remediation by federal agencies.
Key findings
- Two Fortinet vulnerabilities, CVE-2026-25089 and CVE-2026-39808, added to CISA KEV on July 16, 2026.
- Both CVEs are confirmed to be under active exploitation in the wild.
- Immediate patching and remediation are critical for all organizations using Fortinet products.
- CISA KEV listing mandates urgent action for federal agencies, setting a precedent for all defenders.
CISA has issued a critical alert, adding two Fortinet vulnerabilities, CVE-2026-25089 and CVE-2026-39808, to its Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026. This inclusion signifies that these flaws are actively being exploited by threat actors, posing immediate risks to organizations utilizing Fortinet products. The KEV catalog serves as a definitive list of security vulnerabilities that federal civilian executive branch (FCEB) agencies are mandated to address within specific deadlines, underscoring the severe threat these particular issues represent.
The two distinct vulnerabilities, CVE-2026-25089 and CVE-2026-39808, have both been confirmed as actively exploited. While specific details regarding the nature of the exploits or the affected Fortinet products were not immediately disclosed, their presence in the KEV catalog indicates that adversaries have successfully weaponized these flaws to compromise systems. Organizations must treat these listings with the highest priority, as active exploitation dramatically increases the likelihood of successful attacks.
The addition of these Fortinet flaws to the KEV catalog mandates that FCEB agencies remediate them by specified due dates. However, the urgency extends to all organizations globally, as threat actors do not discriminate based on sector. The confirmed active exploitation means that waiting to patch could leave systems vulnerable to immediate compromise, potentially leading to data breaches, service disruptions, or further network infiltration.
Defenders are strongly advised to identify all instances of Fortinet products within their environments and immediately apply available patches or mitigation strategies for CVE-2026-25089 and CVE-2026-39808. Prioritizing these updates is crucial to prevent exploitation and secure critical infrastructure. Regular monitoring for suspicious activity on Fortinet devices should also be enhanced, and incident response plans should be ready for activation.