Fortinet FortiSandbox: OS command injection allows unauthenticated code execution
Deadline for US federal agencies: 19 Jul 2026
Summary
FortiSandbox 4.4.0 through 4.4.8 contains an OS command injection flaw (CWE-78) in the API. An unauthenticated remote attacker can send crafted HTTP requests to execute arbitrary commands on the appliance, reportedly with root privileges. CISA lists the vulnerability as actively exploited, and public proof-of-concept code exists.
Affected
- FortiSandbox 4.4.0 through 4.4.8
- FortiSandbox PaaS versions 23.4.4374, 23.4.4350, 23.3.4329, 23.1.4245, 22.2.4151, 22.2.4134, 22.1.4113, 21.4.4072 and 21.3.4055 (per CVE record)
- Not affected per Fortinet: FortiSandbox 5.0 and PaaS 5.0
Fixed in
- FortiSandbox 4.4.9 or above (Fortinet PSIRT)
- FortiSandbox PaaS 5.0.2 or above (CVE record)
- Unknown: whether 4.4.9 is the latest fixed release; a later Fortinet advisory reportedly lists fixes in 4.4.10, not verified.
Workaround
- No vendor workaround documented. Patching is the fix.
- Restrict management interface access to trusted networks and IP addresses; do not expose it to the internet. This reduces exposure but is not a fix.
Exploitation
- Listed in CISA KEV (added 16 July 2026).
- Public proof-of-concept exploit available on GitHub; a third-party detection template exists.
- Exploitation attempts matching the public PoC have reportedly been observed since mid-June 2026; the exact first date is unknown.
Our recommendation
- Inventory all FortiSandbox instances, including PaaS and cloud deployments.
- Upgrade 4.4.x appliances to the latest fixed 4.4.x release, at least 4.4.9.
- Remove internet exposure of the management interface and restrict access to trusted hosts.
- Review logs for unexpected processes, unknown HTTP requests to the API, and files written to the web root.
- Check whether the appliance was exposed before patching, since exploitation may predate the fix.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (7 repositories)
samu-delucas/CVE-2026-39808 · 0xBlackash/CVE-2026-39808 · ynsmroztas/FortiSandbox-RCE-Exploit-CVE-2026-39808 · HORKimhab/CVE-2026-39808 · error-inside/CVE-2026-39808
Research sources
- Fortinet PSIRT FG-IR-26-100 fortiguard.fortinet.com
- NVD: CVE-2026-39808 nvd.nist.gov
- CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
- CISA alert, 16 July 2026 www.cisa.gov
- PoC reference repository github.com
- CrowdSec vulnerability report www.crowdsec.net
- Arctic Wolf blog arcticwolf.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 19:54.
Original description (NVD)
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.