CVE-2026-39813

This bug lets an attacker trick FortiSandbox into looking at files it should not be able to access by using “../” style paths (like walking out of a locked room to reach something stored elsewhere). The report says this can lead to an escalation of privilege, meaning the attacker may be able to do more than they should after getting the flaw to trigger. Think of it like bypassing the security guard at a storage facility by giving directions that point to a different hallway than intended.

This matters to you if you run Fortinet FortiSandbox (including FortiSandbox 5.0.0 through 5.0.5, and FortiSandbox 4.4.0 through 4.4.8) or use Fortinet FortiSandbox Cloud. It is the type of vulnerability that can affect organizations that rely on FortiSandbox for analyzing or processing network content and want to keep that environment tightly controlled. Based on the information provided, the affected product names are Fortinet FortiSandbox and Fortinet FortiSandbox Cloud.

This is RED urgency because exploitation is reported “itw” (in the wild) and press attention is rising specifically due to active exploitation. With that kind of real-world targeting, waiting typically increases the odds that your system will be probed and attacked. Even though no public exploit is known, attackers can still act without needing one-click tools.

1. Identify exposure

• Inventory every Fortinet FortiSandbox instance you run (on-prem and any FortiSandbox Cloud usage).
• Verify the exact version for each device/service. The affected ranges called out here are FortiSandbox 5.0.0 through 5.0.5 and FortiSandbox 4.4.0 through 4.4.8.

2. Patch / upgrade

• Obtain and apply Fortinet’s remediation for CVE-2026-39813. The critical goal is to move to a version not in the affected ranges.
• Coordinate with your normal maintenance window if needed, but prioritize this update because exploitation is reported in the wild.

3. Mitigate while patching (if immediate upgrade isn’t possible)

• Restrict network access to FortiSandbox management and any externally reachable endpoints as tightly as possible (allow only required admin sources and required traffic paths).
• If FortiSandbox is reachable from the internet for any service/port, confirm whether it can be limited to internal networks or specific IPs.

4. Monitoring and validation

• Check logs and alerts around the time of recent activity for signs of path traversal attempts or other suspicious access patterns.
• Review any FortiSandbox access/control events that could indicate an attacker successfully increased privileges (for example, unusual admin actions or unexpected changes).
• After updating, verify stability and that FortiSandbox’s security/processing functions still work as expected.

5. Operational follow-through

• Confirm that backups and recovery procedures are intact, so you can respond quickly if an incident is found.
• If you suspect compromise, treat it as an incident: contain access, preserve logs, and involve your incident response process or a qualified security consultant.

Severity: The provided CVSS is 9.8 (CRITICAL), and the overall response here is RED based on exploitation being reported “itw” and press attention rising due to active exploitation.

What it is: The vulnerability is described as a path traversal flaw involving “../filedir”, which can allow an attacker to reach files or directories outside of the intended path.

Impact: The technical description states it may allow an attacker to escalation of privilege. This means that after triggering the traversal, the attacker may be able to perform actions with higher permissions than intended.

Affected software: Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8; also Fortinet FortiSandbox Cloud.

Exploitation status: Known exploited in the wild (CISA KEV) is listed as no, but the press/exploitation status provided says “itw” and that press attention is rising because of exploitation.

Public exploit / detections: Public exploit available is no, and a Nuclei detection template exists is no—so detection might rely on vendor guidance, log review, and your environment’s monitoring rather than ready-made signatures.

EPSS/meaning: EPSS is 18.0% estimated probability of exploitation in the next 30 days. In general terms, EPSS is a risk estimate for likelihood of exploitation; here it supports the urgency, especially combined with “itw”.

Attack vector details: The technical description includes a placeholder (“via ”), so the exact vector is not provided in the information you shared.