THREATOPS

THREAT OPS › CVEs › CVE-2026-39808

CVE-2026-39808 — Fortinet FortiSandbox OS Command Injection Vulnerability

CISA KEVExploited: confirmedFortinet

Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.

Vulnerability details

Affected productsFortiSandbox
KEV remediation due2026-07-19

Related reporting

July 2026 CVE Landscaperecordedfuture
[CISA KEV] CVE-2026-39808 — Fortinet FortiSandbox: Fortinet FortiSandbox OS Command Injection Vulnerabilitycisa_kev
June 2026 CVE Landscaperecordedfuture
Fortinet security advisory (AV26-351) – Update 2cccs_ca