Fortinet FortiSandbox Faces Critical Command Injection Flaw

The National Vulnerability Database has flagged a critical vulnerability, CVE-2026-39808, impacting Fortinet FortiSandbox devices. Specifically, versions 4.4.0 through 4.4.8 are susceptible to an OS command injection flaw due to improper neutralization of special elements within an OS command. This weakness could allow an unauthenticated attacker to execute arbitrary code or commands on the affected system.

The vulnerability carries a severe CVSS score of 9.8, classifying it as ‘CRITICAL’. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a high-impact attack that is network-exploitable, requires no privileges, and has no user interaction. Attackers could leverage this to gain full control over compromised devices, potentially leading to data exfiltration or further network compromise.

While the specific attack vector remains to be detailed, the nature of OS command injection in network-facing appliances like FortiSandbox is a significant concern. Organizations relying on these solutions for threat analysis and prevention should prioritize understanding the implications and verifying their systems are patched or protected.