PT-2026-32687 · Fortinet · Fortisandbox+1

Published 2026-04-14 · Updated 2026-04-14 · CVE-2026-39808

X.com · Ptdbugs

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE: CVE-2026-39808 PT ID: PT-2026-32687 Vendor: Fortinet Product: FortiSandbox CVSS: 9.1 Credits: n/a

Description: A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via

References: • https://t.co/J5U6Pyl49r • https://t.co/bSrDZYVWFE

#dbugs vuln

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-39808

Affected Products

Fortisandbox

Fortisandbox Paas

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-39808 · Security Note
• https://twitter.com/rxerium/status/2044163713457143865 · Twitter Post
• https://fortiguard.fortinet.com/psirt/FG-IR-26-100 · Note
• https://twitter.com/ptdbugs/status/2044120723220811801 · Twitter Post