Fortinet FortiSandbox OS Command Injection Vulnerability Added to CISA KEV List

## Overview CISA added CVE-2026-39808 to its Known Exploited Vulnerabilities (KEV) list on July 16, 2026. This vulnerability affects Fortinet's FortiSandbox versions 4.4.0 through 4.4.8. It allows unauthenticated attackers to execute unauthorized commands through crafted HTTP requests. The high CVSS score of 9.8 indicates the severity of this issue. ## Technical Details The vulnerability arises from improper neutralization of special elements in OS commands. Attackers can exploit this flaw by sending specially crafted HTTP requests to the FortiSandbox. This could lead to arbitrary code execution on the affected systems. The vulnerability is particularly concerning due to the ease of exploitation and the potential for significant impact. ## Impact Successful exploitation of CVE-2026-39808 could allow attackers to gain control over affected FortiSandbox instances. This could lead to unauthorized access to sensitive data, disruption of services, or further attacks on the network. Given the nature of the vulnerability, organizations using vulnerable versions are at high risk. ## Mitigation Fortinet has released patches to address this vulnerability. Organizations should update their FortiSandbox installations to the latest version immediately. Regularly reviewing and applying security updates is essential to protect against such vulnerabilities. Additionally, monitoring for unusual activity and implementing network segmentation can help mitigate potential impacts.