cisa-kev

Fortinet FortiSandbox contains a critical unauthenticated OS command injection vulnerability (CVE-2026-25089) actively exploited in the wild, added to CISA's Known Exploited Vulnerabilities catalog on July 16, 2026.

A maximum-severity unauthenticated OS command injection vulnerability (CVE-2026-10520, CVSS 10.0) in Ivanti Sentry is actively exploited, with public PoC released and CISA KEV listing demanding a 3-day remediation. The article details how to identify exposed Ivanti Sentry instances on networks.