# CVE-2026-39808

## Summary

- **CVE ID:** CVE-2026-39808
- **Severity:** CRITICAL
- **CVSS Score:** 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
- **CWE:** CWE-78
- **Published:** Apr 14, 2026
- **Last Modified:** Jul 17, 2026

## Description

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

## Affected Products

- Fortinet — FortiSandbox (4.4.0)
- Fortinet — FortiSandbox PaaS (23.4.4374)
- Fortinet — FortiSandbox PaaS (23.4.4350)
- Fortinet — FortiSandbox PaaS (23.3.4329)
- Fortinet — FortiSandbox PaaS (23.1.4245)
- Fortinet — FortiSandbox PaaS (22.2.4151)
- Fortinet — FortiSandbox PaaS (22.2.4134)
- Fortinet — FortiSandbox PaaS (22.1.4113)
- Fortinet — FortiSandbox PaaS (21.4.4072)
- Fortinet — FortiSandbox PaaS (21.3.4055)

## References

- [CNA](https://fortiguard.fortinet.com/psirt/FG-IR-26-100)
- [CISA-ADP](https://github.com/samu-delucas/CVE-2026-39808)
- [CISA-ADP](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39808)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 92.82%
- **EPSS Percentile:** 99.8

## Known Exploited Vulnerabilities (KEV)

- **Date Added:** Jul 16, 2026
- **Due Date:** Jul 19, 2026

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._