CVE-2026-39808
Fortinet FortiSandbox OS Command Injection Vulnerability
Description
CVE-2026-39808 is a critical OS command injection vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 that may allow an attacker to execute unauthorized code or commands. The flaw is rated CVSS 9.8 (Critical) and requires no authentication and no user interaction, making the FortiSandbox appliance remotely compromisable over the network. Public exploit code is available, CISA has confirmed active exploitation by adding CVE-2026-39808 to its Known Exploited Vulnerabilities (KEV) catalog with a due date of 2026-07-19, and the EPSS score of 84.2% places it in the 99.7th percentile of all CVEs. Organizations running affected FortiSandbox versions should treat this Fortinet vulnerability as an emergency and patch immediately.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortinet | fortisandbox | >= 4.4.0, <= 4.4.9 |
References
- https://fortiguard.fortinet.com/psirt/FG-IR-26-100(Vendor Advisory)
- https://github.com/samu-delucas/CVE-2026-39808(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39808(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OS command injection occurs when software constructs an operating system command from externally influenced input without correctly neutralizing special elements such as shell metacharacters. In FortiSandbox, attacker-controlled input reaches code that builds OS commands, allowing injected shell content to execute arbitrary commands on the underlying appliance operating system.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
With a CVSS 3.1 base score of 9.8 (Critical), CVE-2026-39808 combines the most dangerous exploitability characteristics: it is remotely exploitable without physical access, easy to exploit with no special conditions needed, requires no authentication, and needs no user action. Confidentiality (High): command execution on a FortiSandbox appliance exposes configurations, credentials, and the analysis artifacts the device processes. Integrity (High): an attacker can modify the appliance's behavior — a severe outcome for a malware-analysis sandbox, since the compromised system is exactly the one meant to detect malicious activity. Availability (High): arbitrary commands allow the attacker to disrupt or disable the sandbox service entirely. Given the EPSS score of 84.2%, active exploitation is highly likely, and combined with the CISA KEV listing, any exposed FortiSandbox 4.4.x instance should be assumed to be under attack.
Exploit Maturity
Public exploit code is available for CVE-2026-39808 via a GitHub repository tagged as an exploit and third-party advisory, meaning attackers do not need to develop their own tooling. CISA has confirmed active exploitation in the wild through the KEV listing (due date 2026-07-19); ransomware usage is currently marked as Unknown. The EPSS score of 84.2% (99.7th percentile) indicates near-certain exploitation activity — among the highest of all tracked CVEs. This combination of public PoC, KEV confirmation, and extreme EPSS makes CVE-2026-39808 an act-now vulnerability for every affected FortiSandbox deployment.
Remediation
- Follow the CISA KEV required action: "Apply mitigations in accordance with vendor instructions", ensuring compliance with CISA's BOD 26-04 risk-based patching guidance and CISA's Forensics Triage Requirements — and discontinue use of the product if mitigations are unavailable. The KEV due date is 2026-07-19.
- Upgrade FortiSandbox per the Fortinet advisory FG-IR-26-100. The vulnerability affects FortiSandbox 4.4.0 through 4.4.8 (product data lists 4.4.x builds up to 4.4.9 as affected), so move to the fixed release named in the advisory as soon as possible.
- Until patched, restrict network access to the FortiSandbox appliance: confine management and service interfaces to dedicated admin networks, remove any internet exposure, and enforce strict firewall rules.
- Hunt for compromise rather than only patching: review appliance and HTTP logs for anomalous requests, unexpected processes, and configuration changes. Because public exploit code exists and exploitation is confirmed, perform forensic triage on any FortiSandbox that was exposed while unpatched.
- As long-term hardening against OS command injection (CWE-78), the underlying defense is avoiding shell invocation with untrusted input and using parameterized APIs — for operators, the practical takeaway is to minimize the appliance's exposed attack surface and track Fortinet PSIRT advisories closely.
Technical Details
CVE-2026-39808 stems from improper neutralization of special elements in an OS command (CWE-78): FortiSandbox builds operating system commands using externally influenced input and fails to neutralize characters that alter the intended command. OS command injection specifically targets the system shell, so injected metacharacters let an attacker chain or replace commands, which then execute with the privileges of the FortiSandbox process on the appliance. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H documents the exploitability: network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high impact across confidentiality, integrity, and availability with unchanged scope (S:U). The NVD description does not specify the exact injection vector, but the metrics establish that it is reachable remotely without credentials, and the existence of a public proof-of-concept confirms practical exploitability.
Frequently Asked Questions
Is CVE-2026-39808 being actively exploited?
Yes. CVE-2026-39808 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming exploitation in the wild, and public exploit code is available on GitHub. Its EPSS score of 84.2% places it in the 99.7th percentile, indicating near-certain ongoing exploitation activity.
What products are affected by CVE-2026-39808?
The vulnerability affects Fortinet FortiSandbox versions 4.4.0 through 4.4.8, with affected-product data listing 4.4.x builds up to 4.4.9. Other FortiSandbox release trains are not listed as affected by this specific CVE.
How do I fix CVE-2026-39808?
Upgrade FortiSandbox to the fixed release specified in Fortinet advisory FG-IR-26-100 before the CISA KEV due date of 2026-07-19. Until then, restrict network access to the appliance to trusted management networks and review logs for signs of compromise, since public exploit code is circulating.
How severe is CVE-2026-39808?
CVE-2026-39808 is rated Critical with a CVSS 3.1 base score of 9.8: it enables unauthenticated remote command execution with high impact on confidentiality, integrity, and availability. With an EPSS percentile of 99.7 and confirmed exploitation, it ranks among the most urgent vulnerabilities currently tracked.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.