CVE-2026-39808

Two critical security vulnerabilities, CVE-2026-39808 and CVE-2026-39813, have been identified in Fortinet FortiSandbox versions 4.4.0 through 4.4.8, with CVE-2026-39813 additionally affecting versions 5.0.0 through 5.0.5. These flaws arise from OS command injection and path traversal, types of vulnerabilities that allow attackers to manipulate system commands and directory structures, potentially leading to unauthorized actions such as arbitrary code execution and privilege escalation. In affected versions, an attacker can exploit these vulnerabilities by sending specially crafted HTTP requests, leading to unauthorized code execution or authentication bypass. Notably, both flaws can be exploited by completely unauthenticated remote attackers, requiring no prior privileges or user interaction.

EPSS 91.21% · 99.8th percentile