Act now:FortiSandbox: Two Exploited Pre-Auth Command Injections. Owners of on-premises FortiSandbox appliances and VMs on 4.2, 4.4.0-4.4.8 or 5.0.0-5.0.5, and FortiSandbox PaaS 5.0.4-5.0.5, most urgently where the web UI or API is reachable from untrusted networks.
Check exposure:Windows IKE CVE-2026-33824: Exploited Pre-Auth RCE. Owners of Windows hosts that act as IKEv2 responders (RRAS or IKEv2 VPN servers, Windows IPsec gateways) or otherwise accept UDP 500/4500 from the internet or untrusted networks, if they lack the April 2026 or later update.
Do you run any of these? Microsoft SharePoint Server, Microsoft Office. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-04-28.
If any FortiSandbox runs 4.2, 4.4 below 4.4.9 or 5.0 below 5.0.6, upgrade now and check it for compromise: both bugs need no login, one has a public exploit, and attacks began in June.
Must act: Owners of on-premises FortiSandbox appliances and VMs on 4.2, 4.4.0-4.4.8 or 5.0.0-5.0.5, and FortiSandbox PaaS 5.0.4-5.0.5, most urgently where the web UI or API is reachable from untrusted networks.
Can relax: FortiSandbox 5.2 users and anyone already on 4.4.9 or 5.0.6 or later; Fortinet says it remediated FortiSandbox Cloud itself and customers need not act.
Record the firmware version of every FortiSandbox appliance, VM and PaaS instance.
Upgrade 4.4.x to 4.4.9 or later and 5.0.x to 5.0.6 or later, or move to 5.2; move 4.2 systems to a supported branch, since there is no 4.2 fix.
Restrict the management web UI and API to a dedicated admin network or jump host; never expose them to the internet.
The fix shipped in April, so most fleets are already covered; the real risk is any unpatched Windows host that answers IKE on UDP 500 or 4500 from untrusted networks, and those need patching or blocking today.
Must act: Owners of Windows hosts that act as IKEv2 responders (RRAS or IKEv2 VPN servers, Windows IPsec gateways) or otherwise accept UDP 500/4500 from the internet or untrusted networks, if they lack the April 2026 or later update.
Can relax: Fleets on the April 14, 2026 or any later cumulative update, and hosts where UDP 500/4500 is not reachable from untrusted networks, need only confirm that.
Find every Windows host that accepts UDP 500 or 4500 from the internet or untrusted networks, starting with RRAS, IKEv2 VPN and IPsec gateway servers.
Confirm those hosts run the April 14, 2026 update or later; patch any that do not today.
Block inbound UDP 500 and 4500 at the perimeter and host firewall wherever IKE is not used.