CVE-2026-39808: Fortinet FortiSandbox Pre-Auth OS Command Injection: Unauthenticated Root RCE, CVSS 9.1

Frequently asked questions

What is CVE-2026-39808?

CVE-2026-39808 is an improper neutralization of special elements used in an OS command (CWE-78) in Fortinet FortiSandbox — the product Fortinet sells as a sandboxing and threat analysis platform for inspecting suspicious files, URLs, and email attachments before they reach endpoints.

Is CVE-2026-39808 being actively exploited?

At time of writing, CISA has not added CVE-2026-39808 to the Known Exploited Vulnerabilities catalog, and Fortinet's advisory does not report observed exploitation in the wild. However, several factors make active exploitation highly probable in the near term:

Am I exposed to CVE-2026-39808?

FortiSandbox is deployed at the network perimeter as part of the Fortinet Security Fabric — it receives potentially malicious files from FortiGate, FortiMail, and FortiWeb for analysis. Many deployments are accessible from internal networks and some from the internet directly. This is exactly the kind of high-value security infrastructure target that ransomware operators and nation-state actors prioritize: compromise the sandbox, and you can ensure your malware passes inspection without raising alarms.

How do I fix CVE-2026-39808?

FortiSandbox management interfaces should not be exposed to the internet. If they are, firewall them now. Even on internal networks, limit access to administrative subnets and specific source IPs. The job tracing endpoint is part of the web UI, so blocking external access to port 443 on the appliance eliminates the attack vector entirely for externally-facing instances.