OS Command Injection Vulnerability in Fortinet FortiSandbox
CVE-2026-39808

9.1CRITICAL

Key Information:

Vendor

Fortinet
Status
Fortisandbox
Fortisandbox Paas
Vendor
CVE Published:
14 April 2026

What is CVE-2026-39808?

An OS command injection vulnerability exists in Fortinet FortiSandbox versions 4.4.0 through 4.4.8. This flaw arises from improper neutralization of special elements used in operating system commands. An attacker can exploit this vulnerability to execute unauthorized commands, potentially compromising the system's integrity and allowing for unauthorized access.

Affected Version(s)

FortiSandbox 4.4.0 <= 4.4.8

FortiSandbox PaaS 23.4.4374

FortiSandbox PaaS 23.4.4350

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-100

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.