Known vulnerability record
CVE-2026-39808
Fortinet FortiSandbox OS Command Injection Vulnerability
Summary
Fortinet FortiSandbox OS Command Injection Vulnerability
Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
Signals
Keep the signals separate
CVSS severitycriticalScore 9.1 · source fortinet
EPSS probability91.2%Probability of exploitation in the next 30 days; not severity
CISA KEVKnown exploitedAdded 2026-07-16
Ransomware useunknownPreserved as known / unknown, not a truthy default
Timeline
Dates and provenance
- CVE published
- 2026-04-14
- CVE modified
- 2026-07-17
- KEV date added
- 2026-07-16
- Dataset fetched
- 2026-08-21T03:55:05.519Z
Sources
Original records
- https://www.cve.org/CVERecord?id=CVE-2026-39808 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-39808 ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39808 ↗
Version history: normalized permanent page created 2026-08-20. Machine-enriched fields remain source-attributed.