Fortinet FortiSandbox OS Command Injection Vulnerability

cve CVE-2026-39808 1 source, 1 claim · Watch

CISA Known Exploited Vulnerabilities writes:
Fortinet FortiSandbox OS Command Injection Vulnerability Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. St… the claim

What each source says

Property	Source	Said	Means here
Cwes cwes	CISA Known Exploited Vulnerabilities	CWE-78 receipt Source CISA Known Exploited Vulnerabilities Its words `CWE-78` Read by `field:cwes` Said since 2026-09-28 11:44 UTC Last answered 2026-10-02 16:00 UTC What the source handed over { "cveID": "CVE-2026-39808", "cwes": "CWE-78", "dateAdded": "2026-07-16", "dueDate": "2026-07-19", "forensicTriage": "Yes", "knownRansomwareCampaignUse": "Unknown", "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-39808", "product": "FortiSandbox", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "shortDescription": "Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.", "vendorProject": "Fortinet", "vulnerabilityName": "Fortinet FortiSandbox OS Command Injection Vulnerability" }	—
Due date due_date	CISA Known Exploited Vulnerabilities	2026-07-19 receipt Source CISA Known Exploited Vulnerabilities Its words `2026-07-19` Read by `field:dueDate` Said since 2026-09-28 11:44 UTC Last answered 2026-10-02 16:00 UTC What the source handed over { "cveID": "CVE-2026-39808", "cwes": "CWE-78", "dateAdded": "2026-07-16", "dueDate": "2026-07-19", "forensicTriage": "Yes", "knownRansomwareCampaignUse": "Unknown", "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-39808", "product": "FortiSandbox", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "shortDescription": "Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.", "vendorProject": "Fortinet", "vulnerabilityName": "Fortinet FortiSandbox OS Command Injection Vulnerability" }	—
Exploited exploited	CISA Known Exploited Vulnerabilities	yes receipt Source CISA Known Exploited Vulnerabilities Its words `yes` Read by `const:yes` Said since 2026-09-28 11:44 UTC Last answered 2026-10-02 16:00 UTC What the source handed over { "cveID": "CVE-2026-39808", "cwes": "CWE-78", "dateAdded": "2026-07-16", "dueDate": "2026-07-19", "forensicTriage": "Yes", "knownRansomwareCampaignUse": "Unknown", "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-39808", "product": "FortiSandbox", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "shortDescription": "Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.", "vendorProject": "Fortinet", "vulnerabilityName": "Fortinet FortiSandbox OS Command Injection Vulnerability" }	—
Forensic triage forensic_triage	CISA Known Exploited Vulnerabilities	true receipt Source CISA Known Exploited Vulnerabilities Its words `Yes` Read by `field:forensicTriage` Said since 2026-09-28 11:44 UTC Last answered 2026-10-02 16:00 UTC What the source handed over { "cveID": "CVE-2026-39808", "cwes": "CWE-78", "dateAdded": "2026-07-16", "dueDate": "2026-07-19", "forensicTriage": "Yes", "knownRansomwareCampaignUse": "Unknown", "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-39808", "product": "FortiSandbox", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "shortDescription": "Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.", "vendorProject": "Fortinet", "vulnerabilityName": "Fortinet FortiSandbox OS Command Injection Vulnerability" }	—
Known ransomware campaign use known_ransomware_campaign_use	CISA Known Exploited Vulnerabilities	Unknown receipt Source CISA Known Exploited Vulnerabilities Its words `Unknown` Read by `field:knownRansomwareCampaignUse` Said since 2026-09-28 11:44 UTC Last answered 2026-10-02 16:00 UTC What the source handed over { "cveID": "CVE-2026-39808", "cwes": "CWE-78", "dateAdded": "2026-07-16", "dueDate": "2026-07-19", "forensicTriage": "Yes", "knownRansomwareCampaignUse": "Unknown", "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-39808", "product": "FortiSandbox", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "shortDescription": "Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.", "vendorProject": "Fortinet", "vulnerabilityName": "Fortinet FortiSandbox OS Command Injection Vulnerability" }	—
Product product	CISA Known Exploited Vulnerabilities	FortiSandbox receipt Source CISA Known Exploited Vulnerabilities Its words `FortiSandbox` Read by `field:product` Said since 2026-09-28 11:44 UTC Last answered 2026-10-02 16:00 UTC What the source handed over { "cveID": "CVE-2026-39808", "cwes": "CWE-78", "dateAdded": "2026-07-16", "dueDate": "2026-07-19", "forensicTriage": "Yes", "knownRansomwareCampaignUse": "Unknown", "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-39808", "product": "FortiSandbox", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "shortDescription": "Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.", "vendorProject": "Fortinet", "vulnerabilityName": "Fortinet FortiSandbox OS Command Injection Vulnerability" }	—
Vendor project vendor_project	CISA Known Exploited Vulnerabilities	Fortinet receipt Source CISA Known Exploited Vulnerabilities Its words `Fortinet` Read by `field:vendorProject` Said since 2026-09-28 11:44 UTC Last answered 2026-10-02 16:00 UTC What the source handed over { "cveID": "CVE-2026-39808", "cwes": "CWE-78", "dateAdded": "2026-07-16", "dueDate": "2026-07-19", "forensicTriage": "Yes", "knownRansomwareCampaignUse": "Unknown", "notes": "https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-39808", "product": "FortiSandbox", "requiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "shortDescription": "Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.", "vendorProject": "Fortinet", "vulnerabilityName": "Fortinet FortiSandbox OS Command Injection Vulnerability" }	—

vulnerability

Fortinet FortiSandbox OS Command Injection Vulnerability

zetlyn/cve-kev · 2026-07-16

cwes CWE-78 due_date 2026-07-19 exploited yes forensic_triage true known_ransomware_campaign_use Unknown product FortiSandbox vendor_project Fortinet