CVE-2026-39808 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-04-14

Added to CISA KEV: 2026-07-16 93 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: This CVE is in CISA KEV with confirmed in-the-wild exploitation and public PoC. Immediately hunt for indicators of compromise — review command execution logs, check for unexpected root processes, web shells, unauthorized config changes, and outbound connections. Assume compromise if the management interface was internet-exposed and unpatched.
Immediately upgrade FortiSandbox to version 4.4.9 or above; upgrade FortiSandbox PaaS to version 5.0.2 or above per Fortinet advisory FG-IR-26-100.
As interim mitigation, restrict access to the administrative/API interface to trusted management networks only; block internet exposure of FortiSandbox interfaces and place behind VPN/jump-host access.
Deploy monitoring for anomalous OS command execution patterns and integrate FortiSandbox logs into SIEM; alert on any post-exploitation lateral movement, given this is a trusted security control.
Patch Priority: EMERGENCY / P1 — patch within 24-48 hours or by CISA KEV due date, given active exploitation, root RCE, and unauthenticated network vector.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-39808 is a critical OS command injection vulnerability (CWE-78) affecting Fortinet FortiSandbox versions 4.4.0 through 4.4.8 ^[1]^[5]. The flaw occurs when the sandbox service fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an unauthenticated attacker to execute arbitrary code or commands with root privileges on the host system ^[1]^[2]. This is a high-risk vulnerability because it enables full compromise of the affected device and sandbox environment ^[1]^[4].

Exploitation

Active Exploitation: The vulnerability is confirmed to be exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) Catalog ^[4]^[6].
Threat Actors: It has been identified as being utilized by threat actors targeting FortiSandbox appliances ^[4].
PoC Availability: Public proof-of-concept (PoC) exploit code is available on platforms such as GitHub, demonstrating remote code execution as root ^[2]^[3].
Attack Prerequisites: Exploitation does not require authentication or user interaction; it is a network-based attack vector ^[2]^[3].

Affected Products & Patches

Affected Versions: Fortinet FortiSandbox versions 4.4.0 through 4.4.8 ^[1]^[5].
Patches/Hotfixes: Security updates were released to address this vulnerability. Organizations should verify their current version and update to the latest patched release recommended by Fortinet ^[3].
Mitigations: If patching is delayed, access to the administrative interface should be restricted to trusted networks only, and relevant security monitoring should be in place to detect anomalous command execution patterns ^[1].

Impact

System Access: Successful exploitation provides attackers with arbitrary code execution capabilities with root (uid=0) privileges on the underlying host operating system ^[2]^[3].
Business Risk: For internet-facing deployments, this vulnerability presents a critical business risk, potentially leading to a complete compromise of the appliance, unauthorized access to sensitive data processed by the sandbox, and further lateral movement into the internal network ^[1].

Sources

CVE-2026-39808 - Vulnerability Details - OpenCVE
Fortinet FortiSandbox versions 4.4.0 to 4.4.8 contain an OS command injection flaw (CWE‑78). The flaw originates when the sandbox service accepts unvalidated parameters that are passed directly to the operating system, enabling an attacker to execute arbitrary code on the host. This can compromise t…
GitHub - samu-delucas/CVE-2026-39808: PoC for Unauthenticated RCE in ...
CVE-2026-39808 On November 2025, a critical vulnerability was discovered on Fortinet's FortiSandbox which allowed an unauthenticated attacker to execute commands in the underlying OS as root. The vulnerability was patched and finally made public on April 2026. This vulnerability affects FortiSandbox…
FortiSandbox Root Sandbox Escape - CVE-2026-39808
a critical unauthenticated command injection vulnerability in Fortinet FortiSandbox that allows sandbox escape and remote code execution as ... This repository contains a clean and well-documented Proof of Concept for CVE-2026-39808 — a critical unauthenticated command injection vulnerability in For…
Fortinet FortiSandbox Vulnerability Exploited by Attackers (CVE-2026 ...
CVE-2026-39808: Fortinet FortiSandbox OS Command Injection Vulnerability The vulnerability has a critical severity rating with a CVSS score of 9.1. An improper neutralization of Special Elements used in an OS Command vulnerability in FortiSandbox. ... Threat actors are exploiting three security vuln…
NVD-CVE-2026-39808
CVE-2026-39808 Detail Description A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via …

🔴 CVE-2026-39808