CVE-2026-39808

Summary

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

Affected Software

VendorProductVersion RangeStatus
FortinetFortiSandbox4.4.0 <= 4.4.8affected
FortinetFortiSandbox PaaS23.4.4374affected
FortinetFortiSandbox PaaS23.4.4350affected
FortinetFortiSandbox PaaS23.3.4329affected
FortinetFortiSandbox PaaS23.1.4245affected
FortinetFortiSandbox PaaS22.2.4151affected
FortinetFortiSandbox PaaS22.2.4134affected
FortinetFortiSandbox PaaS22.1.4113affected
FortinetFortiSandbox PaaS21.4.4072affected
FortinetFortiSandbox PaaS21.3.4055affected

Weaknesses

  • CWE-78: Execute unauthorized code or commands

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: total

Additional References

References