What is the CVSS score of CVE-2026-39808?

CVE-2026-39808 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Fortisandbox are affected by CVE-2026-39808?

CVE-2026-39808 is a critical unauthenticated remote command injection vulnerability affecting Fortinet FortiSandbox versions 4.4.0-4.4.8 and PaaS releases 21.3-23.4, allowing complete system…

Is there a public PoC exploit available for CVE-2026-39808?

Yes, a public proof-of-concept exploit is available for CVE-2026-39808. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-39808?

Within 24 hours: identify all FortiSandbox deployments and document affected versions (4.4.0-4.4.8, PaaS 21.3-23.4); isolate affected instances from production networks where feasible. Within 7 days: review Fortinet PSIRT advisory FG-IR-26-100 for updated guidance; implement network segmentation to restrict access to FortiSandbox administrative interfaces; monitor for suspicious process execution on affected systems. Within 30 days: apply vendor-released patch immediately upon availability; test and deploy patched versions to all affected instances; verify remediation across production and non-production environments.

Fortisandbox CVE-2026-39808

EUVD-2026-22338 CRITICAL

OS Command Injection (CWE-78)

2026-04-14 fortinet

GHSA-wfjv-vrx5-2cf2

Fortinet Command Injection Fortisandbox Fortisandbox Paas

9.8

CVSS 3.1 · Vendor: fortinet

Severity by source

Vendor (fortinet) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

Primary rating from Vendor (fortinet).

CVSS VectorVendor: fortinet

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Jul 16, 2026 - 18:18 CISA

PoC Detected

Apr 22, 2026 - 14:17 vuln.today

Public exploit code

Analysis Updated

Apr 17, 2026 - 15:34 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 17:02 vuln.today

CVSS changed

Apr 14, 2026 - 16:22 NVD

9.1 (CRITICAL) 9.8 (CRITICAL)

EUVD ID Assigned

Apr 14, 2026 - 16:00 euvd

EUVD-2026-22338

Analysis Generated

Apr 14, 2026 - 16:00 vuln.today

CVE Published

Apr 14, 2026 - 15:38 nvd

CRITICAL 9.8

DescriptionCVE.org

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

Articles & Coverage 1

POC CVE-2026-39808: Unauthenticated RCE in FortiSandbox 4.4.0-4.4.8 Apr 15, 2026

AnalysisAI

OS command injection in Fortinet FortiSandbox 4.4.0-4.4.8 and FortiSandbox PaaS versions 21.3-23.4 enables remote unauthenticated attackers to execute arbitrary system commands with complete system compromise. CVSS 9.8 (network, low complexity, no privileges) but EPSS 0.29% (53rd percentile) suggests limited real-world exploitation observed despite maximum severity score. No active exploitation confirmed (not in CISA KEV). SSVC framework classifies as automatable with total technical impact but no known exploitation. Fortinet PSIRT advisory FG-IR-26-100 available but description incomplete (missing attack vector specifics).

Technical ContextAI

FortiSandbox is Fortinet's malware analysis and threat intelligence platform for detonating suspicious files in sandboxed environments. The vulnerability (CWE-78) arises from improper neutralization of special characters in user-controlled input passed to OS shell commands. Affected CPE strings identify both on-premise FortiSandbox appliances (versions 4.4.0 through 4.4.8) and FortiSandbox PaaS cloud service (versions spanning 21.3.4055 through 23.4.4374). EUVD tracking indicates 10 distinct affected PaaS builds across major version lines 21.x, 22.x, and 23.x. Command injection flaws typically occur when input validation fails to sanitize shell metacharacters (e.g., semicolons, pipes, backticks) before concatenating user data into system() calls, exec() functions, or similar OS command execution primitives. The CVSS vector confirms network-accessible attack surface with no complexity barriers.

RemediationAI

Apply Fortinet-released patches per advisory FG-IR-26-100 (https://fortiguard.fortinet.com/psirt/FG-IR-26-100). Specific fixed versions not provided in available data - consult advisory directly for exact upgrade targets for both FortiSandbox 4.4.x appliances and FortiSandbox PaaS service instances. For organizations unable to patch immediately, implement network-level access controls to restrict FortiSandbox management interface exposure: (1) enforce firewall rules permitting administrative access only from trusted management VLANs/jump hosts (blocks internet-based exploitation but reduces remote administration convenience), (2) require VPN authentication for all remote access to FortiSandbox interfaces (adds authentication barrier despite PR:N vector, though introduces VPN infrastructure dependency), (3) deploy web application firewall with command injection signature detection in front of management interfaces (adds detection layer but may cause false positives with legitimate administrative commands). Note that compensating controls reduce but do not eliminate risk since vulnerability exists in core command processing - patching remains the definitive solution.