// CVE

CVE-2026-39808

Critical 9.8 Exploited (KEV)

Fortinet FortiSandbox

9.8CVSS
91%EPSS
YesCISA KEV

Summary

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via

Published: 2026-04-14 · In KEV since: 2026-07-16

Analysis

🔴 Critical — actively exploited

How it's exploited: Exploitable over the network (internet-reachable), unauthenticated, no user interaction, and with low complexity.

⚠️ Critical combo: remote, unauthenticated and no interaction → trivial to automate.

Impact: Full compromise (confidentiality, integrity and availability).

Status: Active exploitation confirmed by CISA (KEV).

How to defend:
  • Patch now: it is in CISA's actively-exploited catalog (KEV), with a deadline.
  • Reduce exposure: keep it off the internet; firewall, VPN or network segmentation.
  • Detect: turn this CVE into detection rules.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The vector encodes how it's exploited (translated above, in the analysis). Break it down in the CVSS tool →

🔗 NVD record CISA KEV 🌉 CVE → detection 🎯 Am I exposed? ⚖️ Prioritize patch

← Back to the Threat Radar

Sources: CISA KEV · EPSS · FIRST.org · NVD. Analysis derived from the CVSS vector and exploitation status (no AI). Informational; always verify against the vendor's official advisory.