Log in / Sign up

Vulnerability details

CVE-2026-39808

Actively exploited
Fortinet FortiSandboxFortinet FortiSandbox PaaS
CVSS 3.1
9.1Critical

Official description

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

CVSS scores

ScoreVersionSourceVector
9.1Critical 3.1 CVEProject cvelistV5 (CNA) (fortinet) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Affected products

VendorProductVersionsSource
Fortinet FortiSandbox 4.4.0 ≤ v ≤ 4.4.8 CVEProject cvelistV5 (CNA)
Fortinet FortiSandbox PaaS 21.3.4055 CVEProject cvelistV5 (CNA)
Fortinet FortiSandbox PaaS 21.4.4072 CVEProject cvelistV5 (CNA)
Fortinet FortiSandbox PaaS 22.1.4113 CVEProject cvelistV5 (CNA)
Fortinet FortiSandbox PaaS 22.2.4134 CVEProject cvelistV5 (CNA)
Fortinet FortiSandbox PaaS 22.2.4151 CVEProject cvelistV5 (CNA)
Fortinet FortiSandbox PaaS 23.1.4245 CVEProject cvelistV5 (CNA)
Fortinet FortiSandbox PaaS 23.3.4329 CVEProject cvelistV5 (CNA)
Fortinet FortiSandbox PaaS 23.4.4350 CVEProject cvelistV5 (CNA)
Fortinet FortiSandbox PaaS 23.4.4374 CVEProject cvelistV5 (CNA)

References and advisories

3
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2026-04-14
Last updated
2026-07-17
State
Published
Assigner (CNA)
fortinet
Kolun priority
99 · Critical

CISA KEV catalog

Date added
2026-07-16
Due date
2026-07-19
Used in ransomware
Unknown

Exploit prediction (EPSS)

93.18%
Probability of exploitation in 30 days
99.8%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
Yes
Exploitation
Active
Technical impact
Total

Weaknesses (CWE)

  • CWE-78
    Execute unauthorized code or commands