Vulnary
← back to the feed
Critical· 9.8actively exploited

CVE-2026-39808

CVE-2026-39808 is a critical command injection vulnerability in Fortinet FortiSandbox 4.4.0–4.4.8, allowing attackers to execute unauthorized code via improperly neutralized OS commands. CISA KEV confirms exploitation risk, requiring immediate mitigation per vendor instructions or product discontinuation if fixes are unavailable.

publishedApr 14, 2026
last modifiedJul 17, 2026
sourcesCISA-KEV · NVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
90%
100th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 1, 2026

No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.

01

Who is affected

Users of Fortinet FortiSandbox versions 4.4.0 through 4.4.8

02

Real-world impact

Attackers could execute arbitrary code or commands on affected systems

03

Why this severity

CVSS 9.8 (critical): High confidence in remote exploitation without user interaction or privileges

04

What to do about it

no official fix yet
recommended steps
  1. 01Apply mitigations as instructed by Fortinet
  2. 02Follow CISA BOD 26-04 patching guidelines
  3. 03Discontinue use if mitigations are unavailable
interim mitigations
  • ›Restrict network exposure of affected systems
  • ›Monitor for suspicious command execution activity

CISA KEV guidance and vendor advisories required for exact steps

05

Timeline

  1. Apr 14, 2026 · Apr 14, 2026
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 16, 2026 · 15d ago
    Confirmed exploited (CISA KEV)
    CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
  3. Jul 17, 2026 · 13d ago
    Advisory updated
    The NVD record was last revised.
  4. Jul 19, 2026 · 12d ago
    CISA remediation deadline
    Federal agencies are required to remediate by this date.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

NVD advisory ↗CISA KEV catalog ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →