CVE-2026-39808: Fortinet FortiSandbox OS Command Injection Vulnerability

EPSS trend

Probability

47.36%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

-45.46 pp

From 92.82% on 20-09-2026

20-09-202620-10-2026

EPSS score

47.36%

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 16-07-2026
Federal due date: 19-07-2026

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. fortiguard.fortinet.com/psirt/FG-IR-26-100 nvd.nist.gov/vuln/detail/CVE-2026-39808

Public exploits

1 found

githubUnverified
Cve 2026 39808
Maturity: poc

References

3 links

fortiguard.fortinet.com/psirt/FG-IR-26-100Vendor Advisory
github.com/samu-delucas/CVE-2026-39808ExploitThird Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39808Government ResourceUS Government Resource

Related vulnerabilities

CVE-2018-1356fortinetfortisandbox0.92%7y ago09-04-2019 20:55A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiSandbox before 3.0 may allow an attacker to execute unauthorized code or commands via the back_url parameter in the file scan component.CVE-2021-26105fortinetfortisandbox0.50%1y ago24-03-2025 15:27A stack-based buffer overflow vulnerability (CWE-121) in the profile parser of FortiSandbox version 3.2.2 and below, version 3.1.4 and below may allow an authenticated attacker to potentially execute unauthorized code or commands via specifically crafted HTTP requests.CVE-2025-54353fortinetfortisandbox6.31%10mo ago09-12-2025 17:19An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an attacker to perform an XSS attack via crafted HTTP requests.CVE-2025-52436fortinetfortisandbox7.31%8mo ago10-02-2026 15:39An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an unauthenticated attacker to execute commands via crafted requests.CVE-2025-61886fortinetfortisandbox+20.27%6mo ago14-04-2026 15:38An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox PaaS 5.0.0 through 5.0.4 may allow an attacker to perform an XSS attack via crafted HTTP requests.CVE-2025-53679fortinetfortisandbox+112.20%10mo ago09-12-2025 17:19An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions, FortiSandbox Cloud 24.1, FortiSandbox Cloud 23 all versions allows a remote privileged attacker to execute unauthorized code or commands via crafted HTTP or HTTPS requests.

All vulnerabilities infortisandbox fortisandbox_paas

CVE-2026-39808: Fortinet FortiSandbox OS Command Injection Vulnerability

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References