Security readout for executives and security teams
Plain-English summary
CVE-2026-39808 is a critical Fortinet FortiSandbox command-injection flaw. A network attacker may execute unauthorized commands without authentication or user interaction, according to the CVSS vector. CISA KEV listing indicates known exploitation. The public description still contains an unspecified attack vector, so exposure review should focus on confirmed affected versions and vendor guidance.
Executive priority
Treat this as an urgent remediation item where FortiSandbox is present. Known exploitation, unauthenticated network attack characteristics, and full confidentiality, integrity, and availability impact create business risk beyond routine patching.
Technical view
The vulnerability is CWE-78 improper neutralization of OS command elements in Fortinet FortiSandbox 4.4.0 through 4.4.8 and listed FortiSandbox PaaS builds. CVSS 3.1 is 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The provided record does not specify the vulnerable endpoint or input path.
Likely exposure
Exposure is likely limited to organizations running FortiSandbox 4.4.0-4.4.8 or the listed FortiSandbox PaaS versions. Network reachability matters because the CVSS vector is network-based and unauthenticated. The exact attack vector is not identified in the provided description.
Exploitation context
CISA KEV status supports known exploitation. The source bundle also references a GitHub item tagged as exploit, but no exploit details are needed for validation. The CVE description’s placeholder attack vector is a notable evidence gap.
Researcher notes
Do not assume the vulnerable route or payload from the CVE text; the attack vector is explicitly incomplete. Use the Fortinet PSIRT as the authoritative remediation source and CISA KEV as evidence of exploitation. Avoid testing beyond authorized validation boundaries.
Mitigation direction
- Inventory FortiSandbox and FortiSandbox PaaS versions against the affected lists.
- Review Fortinet FG-IR-26-100 for fixed releases or official mitigations.
- Prioritize upgrade or remediation for any affected, network-reachable deployment.
- Restrict network access to FortiSandbox management and service interfaces where possible.
- Monitor Fortinet advisories and CISA KEV deadlines for updated guidance.
Validation and detection
- Confirm product and build versions from FortiSandbox administration or asset inventory.
- Compare installed versions with FortiSandbox 4.4.0 through 4.4.8.
- Check for listed FortiSandbox PaaS builds in cloud or managed-service inventory.
- Review logs for unusual command execution, administrative changes, or unexpected outbound traffic.
- Document whether the instance is reachable from untrusted networks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-78: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-39808 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C3.95.9fortinetVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- Added to KEVCISA-ADP
CISA Known Exploited Vulnerabilities metadata lists this CVE as known exploited.
- ADP timelineCISA-ADP
CVE-2026-39808 added to CISA KEV
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-07-16T00:00:00.000Z: CVE-2026-39808 added to CISA KEV
Source materials
- CVE List V5 sourceCVE List V5
- https://fortiguard.fortinet.com/psirt/FG-IR-26-100CVE reference, fortinet
- https://github.com/samu-delucas/CVE-2026-39808CVE reference, CISA-ADP · exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-39808CVE reference, CISA-ADP · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.