Intelligence Hub | Category Market Intelligence

Decision at a glance

Top move

CISA added two FortiSandbox vulnerabilities to its Known Exploited Vulnerabilities list, meaning active exploitation evidence exists and buyers must treat FortiSandbox instances as high-priority patch/mitigation targets

Key takeaways

CISA added two FortiSandbox vulnerabilities to its Known Exploited Vulnerabilities list, meaning active exploitation evidence exists and buyers must treat FortiSandbox instances as high-priority patch/mitigation targets.[5]
OVH's emergency fix for the Januscape hypervisor required mass host reboots and showed a cloud operator may push disruptive fixes without granular customer consent; expect supplier-driven downtime and API instability during similar emergency rollouts.[3]
A Google Cloud outage exposed that some services (bare metal, NetApp, VMware Engine) can be effectively tied to a single datacenter and suffer multi-hour outages even when the broader region remains operational—verify physical distribution for critical hosted services.[2]

Why this matters for the category manager

CISA added two FortiSandbox vulnerabilities to its Known Exploited Vulnerabilities list, meaning active exploitation evidence exists and buyers must treat FortiSandbox instances as high-priority patch/mitigation targets. OVH's emergency fix for the Januscape hypervisor required mass host reboots and showed a cloud operator may push disruptive fixes without granular customer consent; expect supplier-driven downtime and API instability during similar emergency rollouts. A Google Cloud outage exposed that some services (bare metal, NetApp, VMware Engine) can be effectively tied to a single datacenter and suffer multi-hour outages even when the broader region remains operational—verify physical distribution for critical hosted services. Research (Bit2Watt) shows malicious or badly behaved GPU workloads can create electrical harmonics that stress datacenter and grid equipment; this is an emerging cyber‑physical threat for AI-heavy hosting and needs monitoring rather than immediate panic

What changed

Added CISA listing for FortiSandbox CVEs after active exploit evidence was reported (new since prior brief).
Included OVH's postmortem-style account of a mass-reboot remediation, providing operational detail not present in the previous brief.
Added hyperscaler outage detail showing discrete-datacenter single-service impacts (Google Cloud europe-west4-a) not covered in last run.

Category impact

Cost / money

Emergency patching and mitigation for FortiSandbox appliances will likely generate immediate IT/IR spend and potential third‑party support costs if in-scope appliances require hotfixes or replacements.[5]
Cloud operator forced reboots and API instability (OVH) can create unplanned recovery work, increased support ticket volumes, and potential expedited engineering costs to restore single-host dependencies.[3]
Two-phase cooling proposals can shift operating-cost profiles and introduce retrofit or integration costs and new supplier dependencies if adopted for GPU-dense racks.[1]

Supplier / commercial

Fortinet may face buyer pressure to clarify patch SLAs, liability for exploited systems, and support response terms; procurement should expect commercial renegotiation windows or emergency support invoices.[5]
OVH's unilateral backporting and regional crash‑test approach signals providers may prioritize safety over consent in emergencies—contract clauses on maintenance notice, forced action, and compensation should be reviewed.[3]
Hyperscaler service models that use discrete datacenters for certain hosted services reduce buyer leverage to demand multi‑facility placement for those services without contract changes.[2]

Safety / operations

Bit2Watt research indicates GPU training jobs can produce power swings that risk equipment overheating or triggering protective sheddings; operations teams must treat large GPU workloads as a potential electrical stability factor.[4]
Google's outage shows operators may proactively throttle or turn down workloads to protect data and hardware during cooling/power faults—expect sudden performance degradation as an operator safety action.[2]
Mass host reboots (OVH) increase the chance of failed recoveries due to latent hardware or firmware faults; runbooks and supplier escalation paths must assume partial recovery failures during wide-scale remediation.[3]

What to watch

Monitor Fortinet advisory timelines and federal directive deadlines closely; public inclusion in KEV usually drives rapid patch cycles and potential regulatory obligations for affected buyers.[5]
Track follow-ups to Bit2Watt and any vendor or utility responses—this research could lead to operational controls on scheduling or GPU throttling if it matures from paper to practical exploit.[4]

Category manager actions

Action detail for this brief

Today's priorities

Identify and inventory all FortiSandbox appliances, virtual instances, and cloud/SaaS integrations in your estate.

because CISA's KEV listing indicates active exploitation and you need an accurate asset list to prioritize patching or isolations.

Due 3d

high

Confirm with critical cloud suppliers which of your hosted services are bound to a single physical datacenter and request their emergency patch/remediation runbooks.

because recent outages and OVH's forced reboot approach show some services may be single‑datacenter and subject to disruptive remediation.

Due 3d

high

Open a commercial review with Fortinet and managed-security providers to clarify emergency patch SLAs, cost pass‑throughs, and support credit mechanics.

because KEV inclusion usually triggers supplier support demands and buyers need clear commercial terms for emergency patching cost responsibilities.

Due 21d

high

Supplier radar

theregister

high

Observed supplier signal

Fortinet may face buyer pressure to clarify patch SLAs, liability for exploited systems, and support response terms; procurement should expect commercial renegotiation windows or emergency support invoices.

Commercial implication

Fortinet may face buyer pressure to clarify patch SLAs, liability for exploited systems, and support response terms; procurement should expect commercial renegotiation windows or emergency support invoices.

Next step: Validate the source-backed signal with incumbents and alternates before the next award or pricing decision.

theregister

high

Observed supplier signal

OVH's unilateral backporting and regional crash‑test approach signals providers may prioritize safety over consent in emergencies—contract clauses on maintenance notice, forced action, and compensation should be reviewed.

Commercial implication

OVH's unilateral backporting and regional crash‑test approach signals providers may prioritize safety over consent in emergencies—contract clauses on maintenance notice, forced action, and compensation should be reviewed.

Next step: Validate the source-backed signal with incumbents and alternates before the next award or pricing decision.

theregister

high

Observed supplier signal

Hyperscaler service models that use discrete datacenters for certain hosted services reduce buyer leverage to demand multi‑facility placement for those services without contract changes.

Commercial implication

Hyperscaler service models that use discrete datacenters for certain hosted services reduce buyer leverage to demand multi‑facility placement for those services without contract changes.

Next step: Validate the source-backed signal with incumbents and alternates before the next award or pricing decision.

Negotiation levers

Lever

Identify and inventory all FortiSandbox appliances, virtual instances, and cloud/SaaS integrations in your estate.

Use when

because CISA's KEV listing indicates active exploitation and you need an accurate asset list to prioritize patching or isolations.

Expected outcome

Inventory with patch/mitigation status and prioritized remediation list for operational teams.

high confidence

Lever

Confirm with critical cloud suppliers which of your hosted services are bound to a single physical datacenter and request their emergency patch/remediation runbooks.

Use when

because recent outages and OVH's forced reboot approach show some services may be single‑datacenter and subject to disruptive remediation.

Expected outcome

Supplier-provided resilience map and runbook excerpts that show where forced actions could impact your workloads.

high confidence

Lever

Open a commercial review with Fortinet and managed-security providers to clarify emergency patch SLAs, cost pass‑throughs, and support credit mechanics.

Use when

because KEV inclusion usually triggers supplier support demands and buyers need clear commercial terms for emergency patching cost responsibilities.

Expected outcome

Amendments or documented supplier commitments that define patch windows, response SLAs, and cost allocation.

high confidence

Talking points

CISA added two FortiSandbox vulnerabilities to its Known Exploited Vulnerabilities list, meaning active exploitation evidence exists and buyers must treat FortiSandbox instances as high-priority patch/mitigation targets.

OVH's emergency fix for the Januscape hypervisor required mass host reboots and showed a cloud operator may push disruptive fixes without granular customer consent; expect supplier-driven downtime and API instability during similar emergency rollouts.

A Google Cloud outage exposed that some services (bare metal, NetApp, VMware Engine) can be effectively tied to a single datacenter and suffer multi-hour outages even when the broader region remains operational—verify physical distribution for critical hosted services.

Recommended actions

Do now

Identify and inventory all FortiSandbox appliances, virtual instances, and cloud/SaaS integrations in your estate.
Why: because CISA's KEV listing indicates active exploitation and you need an accurate asset list to prioritize patching or isolations.
Owner: Ops
Expected outcome: Inventory with patch/mitigation status and prioritized remediation list for operational teams.
[5]
Confirm with critical cloud suppliers which of your hosted services are bound to a single physical datacenter and request their emergency patch/remediation runbooks.
Why: because recent outages and OVH's forced reboot approach show some services may be single‑datacenter and subject to disruptive remediation.
Owner: Contracts
Expected outcome: Supplier-provided resilience map and runbook excerpts that show where forced actions could impact your workloads.
[3]

Next few weeks

Open a commercial review with Fortinet and managed-security providers to clarify emergency patch SLAs, cost pass‑throughs, and support credit mechanics.
Why: because KEV inclusion usually triggers supplier support demands and buyers need clear commercial terms for emergency patching cost responsibilities.
Owner: Contracts
Expected outcome: Amendments or documented supplier commitments that define patch windows, response SLAs, and cost allocation.
[5]
Run a technical and supplier due‑diligence on two‑phase cooling vendors for GPU-dense sites, focusing on coolant supply chains, vendor lock, and retrofit constraints.
Why: because startup claims about higher operating temperatures and energy savings could change sourcing decisions but currently rely on limited vendor evidence.
Owner: Category
Expected outcome: Shortlist with integration risks, coolant procurement implications, and roadmap alignment for densified racks.
[1]

Watch

Update sourcing and contract templates to require physical distribution guarantees or alternative placement options for critical bare‑metal and tightly coupled hosted services.
Why: because the Google and OVH incidents show certain hosted services may be colocated in a single facility and that increases outage exposure.
Owner: Category
Expected outcome: Sourcing policy and contract language that enforce placement, failover, or supplier-funded remediation options for single-site risks.
[2]
Introduce GPU-workload power‑profiling and scheduling obligations into colocation and cloud contracts, including the right to throttle or reschedule noisy tenants.
Why: because Bit2Watt demonstrates that GPU workload power characteristics can affect electrical stability and operator rights to manage load should be contractually available.
Owner: Contracts
Expected outcome: Contract clauses requiring vendor attestation of workload power controls, scheduling limits, and emergency throttle/remediation processes.
[4]

What to watch

Monitor Fortinet advisory timelines and federal directive deadlines closely; public inclusion in KEV usually drives rapid patch cycles and potential regulatory obligations for affected buyers
Track follow-ups to Bit2Watt and any vendor or utility responses—this research could lead to operational controls on scheduling or GPU throttling if it matures from paper to practical exploit
Monitor Fortinet advisory timelines and federal directive deadlines closely; public inclusion in KEV usually drives rapid patch cycles and potential regulatory obligations for affected buyers.: Monitor Fortinet advisory timelines and federal directive deadlines closely; public inclusion in KEV usually drives rapid patch cycles and potential regulatory obligations for affected buyers
Track follow-ups to Bit2Watt and any vendor or utility responses—this research could lead to operational controls on scheduling or GPU throttling if it matures from paper to practical exploit.: Track follow-ups to Bit2Watt and any vendor or utility responses—this research could lead to operational controls on scheduling or GPU throttling if it matures from paper to practical exploit
CISA added two FortiSandbox vulnerabilities to its Known Exploited Vulnerabilities list, meaning active exploitation evidence exists and buyers must treat FortiSandbox instances as high-priority patch/mitigation targets
OVH's emergency fix for the Januscape hypervisor required mass host reboots and showed a cloud operator may push disruptive fixes without granular customer consent; expect supplier-driven downtime and API instability during similar emergency rollouts
A Google Cloud outage exposed that some services (bare metal, NetApp, VMware Engine) can be effectively tied to a single datacenter and suffer multi-hour outages even when the broader region remains operational—verify physical distribution for critical hosted services
Research (Bit2Watt) shows malicious or badly behaved GPU workloads can create electrical harmonics that stress datacenter and grid equipment; this is an emerging cyber‑physical threat for AI-heavy hosting and needs monitoring rather than immediate panic

Market pulse

Index	Latest	Change	As of
Palo Alto (PANW)	320	+0.00 (+0.00%)	Jul 21, 2026, 10:07 AM
CrowdStrike (CRWD)	285	+0.00 (+0.00%)	Jul 21, 2026, 10:07 AM
Zscaler (ZS)	195	+0.00 (+0.00%)	Jul 21, 2026, 10:07 AM
Fortinet (FTNT)	72	+0.00 (+0.00%)	Jul 21, 2026, 10:07 AM

Fortinet: Fortinet KEV inclusion raises near-term commercial and sourcing attention for firewall/sandbox portfolios
CrowdStrike: Endpoint and EDR posture may be revisited alongside sandbox mitigation plans

Evidence and sources

Inline citations jump here. Expand a source to read stored evidence excerpts.

[1] Scalding hot AI accelerators have put datacenters in hot water. Two-phase cooling could chill them out

theregister.com · Jul 21, 2026

Original linkExpand

Source excerpts

Two-phase coolants are nothing new in datacenter cooling

Given the datacenter building boom and electricity supply constraints pushing energy costs higher, the savings could be significant

Barriers to adoption Despite the purported benefits of its two-phase coolant tech, Accelsius still faces some hurdles to widespread adoption

Open original source

[2] Google Cloud outage shows it’s still hard to understand hyperscalers’ real resilience regimes

theregister.com · Jul 21, 2026

Original linkExpand

Source excerpts

Yet this incident shows some services can be tied to a single datacenter in a zone – and that those single datacenters can experience problems while the rest of the zone keeps working

” The important detail there is that Google uses a discrete datacenter for those three services

”Google hasn’t explained how an upstream failure caused that disruption but did say it “proactively turned down workloads in order to protect customer data from any risks posed by running infrastructure in a high temperature environment

Open original source

[3] OVH reveals semi-secret plan to fix critical Januscape hypervisor bug with mass reboots – and an Australian crash-test dummy

theregister.com · Jul 21, 2026

Original linkExpand

Source excerpts

”Hardware hiccupsSome hardware died during the process

That meant customers who rely on a single host would experience some downtime, but OVH’s executive committee signed off on this approach for three reasons:The need to patch before attacks;Treating cases individually would mean the OVH cloud would be vulnerable for longer;A desire to protect the greatest number of customers, and tolerate impact on a minority

virtualization French cloud backported a patch into Debian and didn’t seek customer consent, despite chance of downtime French cloud operator OVH has revealed it used its Sydney, Australia, datacenter as the crash test dummy to test a rapid rollout of a fix for the critical Januscape guest-host escape bug in the Linux kernel-based virtual machine (KVM)

Open original source

[4] Malicious cloud customers can bring down the power grid

theregister.com · Jul 20, 2026

Original linkExpand

Source excerpts

" AI training workloads represent a known challenge for datacenter operators. As Microsoft, Nvidia, and OpenAI noted in a 2025 research paper arguing the need for power stabilization during AI training, the transition from GPU computation to GPU data synchronization causes large power swings to occur

As Microsoft, Nvidia, and OpenAI noted in a 2025 research paper arguing the need for power stabilization during AI training, the transition from GPU computation to GPU data synchronization causes large power swings to occur. And if the frequency spectrum of these power swings is "harmonized with critical frequencies of utilities, [that] can cause physical damage to the power grid infrastructure

As Microsoft, Nvidia, and OpenAI noted in a 2025 research paper arguing the need for power stabilization during AI training, the transition from GPU computation to GPU data synchronization causes large power swings to occur

Open original source

[5] Attackers target critical FortiSandbox flaws as CISA issues patch order

theregister.com · Jul 17, 2026

Original linkExpand

Source excerpts

For federal civilian agencies, bugs landing in KEV come with homework. Binding Operational Directive 26-04 requires them to patch within CISA's deadlines or pull the plug on vulnerable products if they can't be adequately secured

1 and affect FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS

Fortinet has not publicly confirmed that either flaw is being exploited in the wild, but CISA has now added both bugs to its Known Exploited Vulnerabilities (KEV) catalog. Inclusion in the catalog means CISA has evidence that the vulnerabilities are being actively exploited, although the agency rarely attributes attacks or discloses how widespread they are

Open original source

[6] Fortinet

finance.yahoo.com · n.d.

Original linkExpand

No stored excerpt is attached to this source.

Open original source

[7] CrowdStrike

finance.yahoo.com · n.d.

Original linkExpand

No stored excerpt is attached to this source.

Open original source

Tighten Patch, Cloud Resilience, and Cooling Controls Now

Decision at a glance

What changed

Category impact

Cost / money

Supplier / commercial

Safety / operations

What to watch

Action detail for this brief

Today's priorities

Supplier radar

Negotiation levers

Talking points

Recommended actions

Do now

Next few weeks

Watch

Top stories

Attackers target critical FortiSandbox flaws as CISA issues patch order

OVH reveals semi-secret plan to fix critical Januscape hypervisor bug with mass reboots – and an Australian crash-test dummy

Google Cloud outage shows it’s still hard to understand hyperscalers’ real resilience regimes

Malicious cloud customers can bring down the power grid

Scalding hot AI accelerators have put datacenters in hot water. Two-phase cooling could chill them out

Market pulse

Evidence and sources