Fortinet FortiSandbox - Command Injection
CVE-2026-39808
Verified
Description
Fortinet FortiSandbox 4.4.0 through 4.4.8 contains a command injection caused by improper neutralization of special elements in OS commands, letting attackers execute unauthorized code or commands, exploit requires crafted input.
Severity
Critical
CVSS Score
9.8
Exploit Probability
47%
Affected Product
fortisandbox
Published Date
April 19, 2026
Template Author
dhiyaneshdk
CVE-2026-39808.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-39808
CWE ID:
cwe-78
Remediation Steps
Upgrade FortiSandbox to version 4.4.9 or later.