First published 10/4/2026, 7:44:15 PM · Last updated 10/4/2026, 7:44:15 PM

CVE-2026-39808: Fortinet FortiSandbox OS Command Injection Vulnerability

The source reports an OS command injection vulnerability in Fortinet FortiSandbox that could allow an unauthenticated attacker to execute unauthorized code or commands through crafted HTTP requests. It calls for applying mitigations in line with vendor instructions and applicable CISA guidance.

Illustrative image: Photo of the firewall Fortinet FortiGate 6501F. — Premeditated/Wikimedia Commons, CC BY-SA 4.0

Categories: technology

Generated scores

Scores are based on the cited reporting and use a 1–10 scale. Read the methodology.

Confidence: 5/10How certain the assessment is based on the clarity and evidence in the cited reporting.
Geographic reach: 1/10How widely the event reaches, from a local area (1) to worldwide impact (10).
Global importance: 2/10The event's broader significance, from limited importance (1) to major global importance (10).
Impact magnitude: 3/10The scale or severity of the real-world impact, from minor (1) to extreme (10).
Positivity: 2/10How harmful or beneficial the event is, from strongly harmful (1) to strongly positive (10).
Urgency: 5/10How time-sensitive the event is, from low urgency (1) to immediate attention needed (10).

Why it matters

The source identifies a potential route to unauthorized code execution and calls for mitigation or discontinuing use if mitigations are unavailable.

Sources

CVE-2026-39808: Fortinet FortiSandbox OS Command Injection Vulnerability

Report an issue