9.1
Critical
CVE-2026-39808 Fortinet FortiSandbox OS Command Injection Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware campaigns
Not observed so far
Weakness
CWE-78
Description
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| FortiSandbox 4.4 | 4.4.0 → 4.4.8 | No fix stated |
| FortiSandbox PaaS 23.4 | 23.4.4350 → 23.4.4374 | No fix stated |
| FortiSandbox PaaS | 23.3.4329 | No fix stated |
| FortiSandbox PaaS | 23.1.4245 | No fix stated |
| FortiSandbox PaaS 22.2 | 22.2.4134 → 22.2.4151 | No fix stated |
| FortiSandbox PaaS | 22.1.4113 | No fix stated |
| FortiSandbox PaaS | 21.4.4072 | No fix stated |
| FortiSandbox PaaS | 21.3.4055 | No fix stated |
Other CVEs of FortiSandbox
The 52 CVEs of FortiSandbox →
CVE-2026-107656
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through…
9.6
Critical
CVE-2026-106172
A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0…
4.9
Medium
CVE-2026-106170
An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox…
4.8
Medium
CVE-2026-26084
A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through…
8.9
High