Fortinet FortiSandbox OS Command Injection (CVE-2026-39808): KEV-Listed Command Injection Under Active Exploitation

What's the vulnerability

CVE-2026-39808 is an OS command injection flaw (CWE-78) in Fortinet FortiSandbox. The root cause is insufficient sanitization of input passed to the management interface, allowing an attacker to inject and execute arbitrary OS commands on the underlying host. Depending on the specific request path exploited, both authenticated and unauthenticated attackers may be able to trigger the issue, resulting in full command execution in the context of the FortiSandbox service.

Affected software

• Vendor: Fortinet
• Product: FortiSandbox

Specific affected version ranges have not been published in our source data at this time; consult Fortinet's advisory for the definitive version matrix and patch guidance before making remediation decisions.

Exploitation status

CVE-2026-39808 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been observed exploited in the wild. As a KEV entry, it is also subject to BOD 26-04 remediation timelines for applicable organizations. Defenders should treat this as an active, not theoretical, threat — patching and compensating detections should be prioritized accordingly, and internet-facing or otherwise exposed FortiSandbox management interfaces should be reviewed immediately.

How our detection catches it

Our coverage focuses on the behavioral fingerprint of command injection against FortiSandbox rather than a single exploit signature, so it holds up across proof-of-concept variations. At a high level, the logic looks for:

• Anomalous shell or command execution originating from FortiSandbox processes themselves
• Suspicious HTTP requests to the FortiSandbox management interface containing shell metacharacters (e.g. ;, |, &&, backticks) in parameters or paths
• Unexpected child processes spawned by FortiSandbox web/API services, correlated via syslog, proxy, or EDR telemetry on adjacent and monitoring hosts

This detection ships across our full SIEM coverage matrix — Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL) — so teams can deploy it in whichever platform anchors their monitoring stack.

Get the full detection

For the complete, ready-to-deploy queries across all supported platforms, see the CVE-2026-39808 detection page.