FortiSandbox
CVE-2026-39808: FortiSandbox OS Command Injection
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| FortiSandbox 4.4.0 to 4.4.8 | 4.4.9 or later |
| FortiSandbox PaaS 23.4 | See the advisory |
| FortiSandbox PaaS 23.4 | See the advisory |
| FortiSandbox PaaS 23.3 | See the advisory |
| FortiSandbox PaaS 23.1 | See the advisory |
| FortiSandbox PaaS 22.2 | See the advisory |
| FortiSandbox PaaS 22.2 | See the advisory |
| FortiSandbox PaaS 22.1 | See the advisory |
| FortiSandbox PaaS 21.4 | See the advisory |
| FortiSandbox PaaS 21.3 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Exploitation
CISA lists this CVE as exploited in the wild since 16 Jul 2026.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.