Fortinet FortiSandbox/FortiSandbox PaaS up to 4.4.8 os command injection

Summaryinfo

A vulnerability described as critical has been identified in Fortinet FortiSandbox and FortiSandbox PaaS up to 4.4.8. Impacted is an unknown function. Such manipulation leads to os command injection. This vulnerability is uniquely identified as CVE-2026-39808. The attack can be launched remotely. Moreover, an exploit is present. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Fortinet FortiSandbox and FortiSandbox PaaS up to 4.4.8. It has been rated as very critical. Affected by this issue is an unknown code block. The manipulation with an unknown input leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

The advisory is available at fortiguard.fortinet.com. This vulnerability is handled as CVE-2026-39808 since 04/07/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but an exploit is available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/17/2026). This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

It is declared as attacked. This issue was added on 07/16/2026 to the CISA Known Exploited Vulnerabilities Catalog with a due date of 07/19/2026:

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BO

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2026-1094). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Fortinet FortiSandbox

Productinfo

Vendor

• Fortinet

Name

• FortiSandbox
• FortiSandbox PaaS

Version

• 4.4.0
• 4.4.1
• 4.4.2
• 4.4.3
• 4.4.4
• 4.4.5
• 4.4.6
• 4.4.7
• 4.4.8

License

• commercial

Website

• Vendor: https://www.fortinet.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion