Fortinet published advisories on April 14 for two critical vulnerabilities in FortiSandbox, its network sandboxing appliance used by enterprises for advanced threat detection and malware analysis. Both carry a CVSSv3 score of 9.1 and are exploitable by unauthenticated remote attackers with nothing more than crafted HTTP requests.
If your org runs FortiSandbox 4.4.x or 5.0.x, stop reading and patch now. Then come back.
CVE-2026-39808: OS Command Injection via API
The first flaw, CVE-2026-39808, is a textbook OS command injection (CWE-78) in the FortiSandbox API component. An unauthenticated attacker can send specially crafted HTTP requests to execute arbitrary OS commands on the underlying system.
Affected versions:
- FortiSandbox 4.4.0 through 4.4.8
- FortiSandbox 5.0.0 through 5.0.5
Fixed in:
- FortiSandbox 4.4.9+
- FortiSandbox 5.0.6+
The vulnerability was responsibly disclosed by Samuel de Lucas Maroto of KPMG Spain.
Command injection in a security appliance is particularly nasty. FortiSandbox sits in a privileged network position — it receives and detonates suspicious files from email gateways, web proxies, and firewalls. Compromising it gives an attacker a foothold in one of the most trusted components of the security stack, with visibility into every malware sample the organization is analyzing.
CVE-2026-39813: Path Traversal to Authentication Bypass
The second vulnerability, CVE-2026-39813, is a path traversal flaw (CWE-24) in the FortiSandbox JRPC API. By manipulating path elements in HTTP requests, an unauthenticated attacker can bypass authentication controls entirely, leading to privilege escalation.
Affected versions and fixes are the same as CVE-2026-39808 — both were addressed in FortiSandbox 4.4.9 and 5.0.6.
Chaining Potential
While Fortinet hasn’t confirmed in-the-wild exploitation yet, the combination of these two flaws is concerning. An attacker could chain CVE-2026-39813 (auth bypass) with CVE-2026-39808 (command injection) to go from zero access to full system compromise in a single attack sequence — no credentials, no user interaction required.
Fortinet appliances have been repeatedly targeted by threat actors in recent months. The FortiClient EMS zero-day (CVE-2026-35616) patched just last week was already being actively exploited before the fix landed. The earlier FortiClient EMS SQL injection (CVE-2026-21643) was added to CISA’s KEV catalog. Attackers clearly have Fortinet’s product line in their crosshairs.
Who’s Affected
FortiSandbox is deployed primarily in mid-to-large enterprises, MSSPs, and government networks. It’s typically integrated with FortiGate firewalls, FortiMail, and FortiWeb as part of Fortinet’s Security Fabric. Any organization running these appliances in an integrated deployment should verify their FortiSandbox version immediately.
What to Do Right Now
- Patch immediately. Upgrade FortiSandbox to 4.4.9+ or 5.0.6+. This is not optional.
- Audit API access. FortiSandbox’s API should not be exposed to untrusted networks. Verify that management interfaces are restricted to dedicated management VLANs or jump hosts.
- Check for indicators of compromise. Review FortiSandbox logs for unusual API calls, unexpected command execution, or authentication anomalies. Pay attention to JRPC endpoint access patterns.
- Network segmentation. If you can’t patch immediately, restrict network access to FortiSandbox management and API interfaces to trusted IPs only.
- Monitor Fortinet’s PSIRT page for updated advisories — given the recent pattern, additional exploitation details may surface.
Fortinet’s advisories are available at fortiguard.fortinet.com/psirt. The relevant advisory IDs are FG-IR-26-0214 (CVE-2026-39808) and FG-IR-26-0216 (CVE-2026-39813).