CVE-2026-39808

This vulnerability could let an attacker trick FortiSandbox into running unintended commands on the server. Think of it like a “tools drawer” that’s supposed to take only specific items—but due to a mistake, someone can slip in instructions to make the drawer hand over something else entirely (unauthorized code/commands).

This matters to you if you use or run Fortinet FortiSandbox versions 4.4.0 through 4.4.8, including Fortinet FortiSandbox PaaS. If your business relies on FortiSandbox to analyze files or traffic, a successful attack could turn that system into a path for executing unauthorized code.

This is RED because exploitation is already happening in the wild and press attention is rising for that reason. Even without a publicly shared exploit, attackers have the capability to take advantage of the weakness, so you should act immediately rather than waiting for confirmation.

1. Identify exposure: confirm which Fortinet FortiSandbox product you use (Fortinet FortiSandbox, Fortinet FortiSandbox PaaS, and/or fortinet fortisandbox) and your exact version. This issue is described for 4.4.0 through 4.4.8.

2. Patch/upgrade: apply Fortinet’s remediation by upgrading to a version outside 4.4.0–4.4.8. Follow Fortinet’s upgrade instructions for your deployment type (appliance vs. PaaS).

3. If patching is not immediately possible:

• Reduce reachability: restrict network access so only the minimum required administrators and systems can reach FortiSandbox.
• Tighten request handling: ensure any interfaces that accept submitted content (the part that ultimately feeds into the command) are not broadly exposed to untrusted users.
• Monitoring: increase logging/alerting around the FortiSandbox service, looking for unusual request patterns, unexpected command execution indicators, or other signs of compromise (exact signals depend on your environment; coordinate with your IT/security team).

4. Validate: after the update, re-check the version, review service health, and confirm any relevant configuration still works.

5. Incident readiness: because exploitation is reported as “itw,” be prepared to investigate quickly if you see suspicious events—especially anything that suggests unauthorized code/command execution. Coordinate with Fortinet guidance and your internal incident process.

CVE-2026-39808 is an improper neutralization of special elements used in an os command (“os command injection”) flaw affecting Fortinet FortiSandbox 4.4.0 through 4.4.8 (Fortinet FortiSandbox, Fortinet FortiSandbox PaaS, and fortinet fortisandbox). The described impact is unauthorized code/command execution.

Exploitation status: press reports indicate exploitation in the wild (“itw”), and press attention is rising because of that. CISA KEV status is noted as “no” (not listed as known exploited by CISA in the provided context). A public exploit is noted as “no,” and there is no Nuclei detection template “no,” so detection/response may rely more on vendor indicators, logs, and monitoring rather than widely available signatures.

EPSS (16.7%) is an estimate of exploitation likelihood over the next 30 days. The traffic-light verdict for this CVE is RED, driven by real-world exploitation reports rather than availability of a public exploit.