CVE-2026-39808
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code
Severity
Critical 9.1
CVSS 3.1
Exploited
Yes — in CISA KEV
Added Jul 16, 2026
EPSS
0.928
99.8th percentile
Discovered by
Vendor
Vendor advisory field
Published
Apr 14, 2026
Assigned by fortinet
Description
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Weakness: CWE-78
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiSandbox | Threat Detection & Sandbox | cna-assigner |
Vendor-reported products (2)
- Fortinet · FortiSandbox
- Fortinet · FortiSandbox PaaS
Credit
Fortinet is pleased to thank Samuel de Lucas Maroto from KPMG Spain for reporting this vulnerability under responsible disclosure.
Vendor remediation
Upgrade to FortiSandbox version 4.4.9 or above Upgrade to FortiSandbox PaaS version 5.0.2 or above