CVE-2026-39808

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

Affected

Fortinet · FortiSandbox · FortiSandbox PaaS

CVSS v3.1 FORTINET

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

47.36% chance of exploitation in the next 30 days, 99th percentile

CISA KEV

added 2026-07-16

Nuclei

critical · CWE-78

Published

2026-04-14

Updated

2026-07-17

Proof-of-concept exploits (7)

• samu-delucas/CVE-2026-398089★ · 2026-04-15
• 0xBlackash/CVE-2026-398082★ · 2026-04-23
• Lechansky/CVE-2026-398080★ · 2026-04-15
• HORKimhab/CVE-2026-398080★ · 2026-06-17
• error-inside/CVE-2026-398080★ · 2026-06-18
• ynsmroztas/FortiSandbox-RCE-Exploit-CVE-2026-3980827★ · 2026-04-21
• gotr00t0day/CVE-2026-398081★ · 2026-10-03

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-39808.yaml

Security advisories

• https://fortiguard.fortinet.com/psirt/FG-IR-26-100

References

• CVE Record
• NVD entry

Related

• CVE-2025-10897
• CVE-2026-10520
• CVE-2026-47670
• CVE-2018-7600
• CVE-2020-25134
• CVE-2025-0133