Dashboard / CVE-2026-39808

CVE-2026-39808

CRITICAL CISA KEV
ACT NOW Priority: 9.13 BB Relevance: 90/100
Published: 2026-04-14 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: High
I: High
A: High

Description

Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.

CISA Known Exploited Vulnerability

Vendor / Product Fortinet — FortiSandbox
Date Added 2026-07-16
Remediation Due 2026-07-19
https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-39808

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
fortinet fortisandbox 4.4.0 – 4.4.9

References & Advisories (3)

https://github.com/samu-delucas/CVE-2026-39808
Exploit Third Party Advisory

Bug Bounty Relevance

90 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction
✓ Known exploited (KEV)
✓ High exploitation probability

CVSS Score

9.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

93.19%
Raw Score 0.931890
Percentile 99.8%
Date 2026-10-28

Intelligence Sources

kev ref →
nvd ref →

External Links