CVE-2026-39808
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code
Severity
Critical 9.1
CVSS 3.1
Exploited
Yes — in CISA KEV
Added Jul 16, 2026
EPSS
0.897
99.8th percentile
Discovered by
Not disclosed
Published
Apr 14, 2026
Assigned by fortinet
Description
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Weakness: CWE-78
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Fortinet | FortiSandbox | Threat Detection & Sandbox | cna-assigner |
Vendor-reported affected versions (2)
- Fortinet · FortiSandbox
- Fortinet · FortiSandbox PaaS
Vendor remediation
Upgrade to FortiSandbox version 4.4.9 or above Upgrade to FortiSandbox PaaS version 5.0.2 or above