Remote code execution affecting FortiSandbox
A vulnerability affecting the Fortinet FortiSandbox security solution would allow an unauthenticated attacker to remotely execute arbitrary code on affected systems.
Description
Technical context and vulnerability details
FortiSandbox is an advanced threat detection solution developed by Fortinet. It is deployed in corporate networks to execute and scan suspicious files securely. This solution is affected by a critical vulnerability labeled CVE-2026-39808, resulting from insufficient validation of special characters when processing system commands within an API interface of the solution. Exploitation of this vulnerability would allow an unauthenticated attacker to send specially crafted HTTP requests, leading to arbitrary command execution in affected systems. It is classified critical with a severity score of 9.1 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Data privacy breach;
- Compromise of system integrity;
Affected systems
Products, components and targeted versions
- Fortinet FortiSandbox versions 4.4.x, ranging from version 4.4.0 to version 4.4.8 inclusive;
- FortiSandbox PaaS versions ranging from version 21.3.4055 to version 23.4.4374;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update Fortinet FortiSandbox to its latest available stable version;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.