CVE-2026-39808

Highest-risk unexploited with PoCs

Exploit code exists, no confirmed in-the-wild activity, ranked by EPSS

Actively Exploited

Confirmed exploited in the wild, sorted by most recently updated

CVSS 9.1EPSS 47%

Published 2026-04-14Updated 2026-06-09

Exploited in the wildMedia 8475PoC

Vulnerability details

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

CNAfortinet

EPSS score history

Sources

38 links

PoC links are not available for guest users. Login to view them.

Profile

CVSS

9.1

EPSS

47%

Published

2026-04-14

Updated

2026-06-09

CNA

fortinet

Vendors

Fortinet

2 products

CPEs

cpe:2.3:a:fortinet:fortisandbox:4.4.8:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandbox:4.4.7:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandbox:4.4.6:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandbox:4.4.5:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4374:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandboxpaas:23.4.4350:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandboxpaas:23.3.4329:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandboxpaas:23.1.4245:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4151:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandboxpaas:22.2.4134:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandboxpaas:22.1.4113:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandboxpaas:21.4.4072:*:*:*:*:*:*:*

cpe:2.3:a:fortinet:fortisandboxpaas:21.3.4055:*:*:*:*:*:*:*

Vulnerability dashboard

Highest-risk unexploited with PoCs

Actively Exploited

Recently Updated