What is the CVSS score of CVE-2026-39813?

CVE-2026-39813 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Fortisandbox are affected by CVE-2026-39813?

CVE-2026-39813 is a critical path traversal vulnerability in Fortinet FortiSandbox versions 4.4.0-4.4.8 and 5.0.0-5.0.5 that permits unauthenticated remote attackers to achieve complete system…

Is there a public PoC exploit available for CVE-2026-39813?

Yes, a public proof-of-concept exploit is available for CVE-2026-39813. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-39813?

Within 24 hours: Identify all FortiSandbox deployments running affected versions (4.4.0-4.4.8, 5.0.0-5.0.5) and isolate them from untrusted networks or disable remote access where operationally feasible. Within 7 days: Consult Fortinet advisory FG-IR-26-112 for definitive patch availability, mitigation guidance, and confirmed affected versions; prepare upgrade plan to patched releases. Within 30 days: Apply vendor-released patch immediately upon availability, or if no patch is released within this window, implement network-layer access controls (IP whitelisting, VPN-only access) to restrict path traversal attack surface.

Fortisandbox CVE-2026-39813

EUVD-2026-22344 CRITICAL

Path Traversal: '../filedir' (CWE-24)

2026-04-14 fortinet

Privilege Escalation Fortinet Path Traversal Fortisandbox Fortisandbox Cloud

9.8

CVSS 3.1 · Vendor: fortinet

Severity by source

Vendor (fortinet) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

Primary rating from Vendor (fortinet).

CVSS VectorVendor: fortinet

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 17, 2026 - 15:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 17:03 vuln.today

CVSS changed

Apr 14, 2026 - 16:22 NVD

9.1 (CRITICAL) 9.8 (CRITICAL)

EUVD ID Assigned

Apr 14, 2026 - 16:00 euvd

EUVD-2026-22344

Analysis Generated

Apr 14, 2026 - 16:00 vuln.today

CVE Published

Apr 14, 2026 - 15:38 nvd

CRITICAL 9.8

DescriptionCVE.org

A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via <insert attack vector here>

AnalysisAI

Path traversal in Fortinet FortiSandbox 4.4.0-4.4.8 and 5.0.0-5.0.5 enables remote unauthenticated attackers to achieve full system compromise. With CVSS 9.8 (AV:N/AC:L/PR:N/UI:N), the vulnerability permits network-based exploitation without credentials or user interaction, leading to complete confidentiality, integrity, and availability impact. Despite critical severity, EPSS score of 0.06% (18th percentile) indicates low observed exploitation probability. No active exploitation confirmed (not in CISA KEV). SSVC framework marks it as automatable with total technical impact but no current exploitation. The incomplete CVE description (placeholder text for attack vector) suggests early disclosure; verify completeness with Fortinet advisory FG-IR-26-112.

Technical ContextAI

CWE-24 (Path Traversal: '../filedir') indicates improper neutralization of directory traversal sequences in file path handling. FortiSandbox is Fortinet's malware analysis and threat intelligence platform, processing uploaded files for behavioral analysis. Affected products per CPE data include FortiSandbox on-premise appliances (versions 4.4.0-4.4.8 and 5.0.0-5.0.5) and FortiSandbox Cloud (versions 23.4, 24.1, and 5.0.4-5.0.5). Path traversal vulnerabilities typically arise when user-controlled input influences file system operations without adequate sanitization of '../' sequences, allowing access to files outside intended directories. Combined with the privilege escalation tag and CVSS impact metrics (C:H/I:H/A:H), this suggests the flaw enables reading, writing, or executing files with elevated privileges, potentially accessing sensitive configuration files, credentials, or system binaries. The network attack vector (AV:N) indicates exposure through FortiSandbox's web management interface or API endpoints rather than requiring local access.

RemediationAI

Upgrade FortiSandbox on-premise appliances to versions beyond 5.0.5 or 4.4.8 as specified in Fortinet advisory FG-IR-26-112 (https://fortiguard.fortinet.com/psirt/FG-IR-26-112). For FortiSandbox Cloud, upgrade beyond versions 24.1 and 5.0.5 per vendor guidance. Until patching is completed, restrict network access to FortiSandbox management interfaces using firewall rules permitting only trusted administrator IP addresses (trade-off: reduces operational flexibility for remote management). Disable internet-facing access to FortiSandbox web interfaces and APIs, requiring VPN or jump host access for administration (trade-off: increases administrative overhead). Monitor FortiSandbox logs for unusual file access patterns, unexpected administrative actions, or access from unauthorized source IPs as potential exploitation indicators. Review FortiSandbox user accounts and privileges to ensure least-privilege access, limiting the impact should credentials be compromised through this vulnerability. Given the path traversal nature, verify file upload functionality is disabled or restricted to authenticated trusted users only (trade-off: may impact automated malware submission workflows).