FortiSandbox: Two Exploited Pre-Auth Command Injections

What to do

1. Record the firmware version of every FortiSandbox appliance, VM and PaaS instance.
2. Upgrade 4.4.x to 4.4.9 or later and 5.0.x to 5.0.6 or later, or move to 5.2; move 4.2 systems to a supported branch, since there is no 4.2 fix.
3. Restrict the management web UI and API to a dedicated admin network or jump host; never expose them to the internet.
4. Until patched, block requests to /fortisandbox/job-detail/tracer-behavior from untrusted sources at an upstream proxy or WAF (covers CVE-2026-39808 only).
5. If the appliance was reachable from untrusted networks while vulnerable, preserve logs, rebuild from a clean image if anything looks wrong, and rotate admin passwords and any credentials or API keys it uses with other devices.

How to check if you are affected or compromised

• Search proxy, WAF and firewall logs for GET requests to /fortisandbox/job-detail/tracer-behavior with a pipe (| or %7C) or other shell metacharacters in the jid parameter.
• Look for follow-up requests to /ng/<filename>.txt, which CrowdSec saw attackers use to confirm that a command ran.
• Check for unexpected files served from the web root, outbound connections from the sandbox to unknown hosts, and new admin accounts or configuration changes.

What happened#

Fortinet fixed two critical, unauthenticated OS command injection flaws (CWE-78) in FortiSandbox, its malware-analysis appliance, two months apart. On April 14, 2026, advisory FG-IR-26-100 covered CVE-2026-39808, titled "OS Command Injection through API endpoint." It was reported by Samuel de Lucas Maroto of KPMG Spain. On June 9, FG-IR-26-141 covered CVE-2026-25089, a "Second-Order OS Command Injection via JSON Input on start vnc feature" in the web UI. Adham El Karn of Fortinet's Product Security team found it internally. Fortinet scores both at CVSS 3.1 9.8 base and 9.1 temporal, and both can be triggered with crafted HTTP requests.

The discoverer's public proof of concept for CVE-2026-39808 shows a pipe character in the jid parameter of a GET request to /fortisandbox/job-detail/tracer-behavior. The injected commands run "as root."

Exploitation followed in June. CyberScoop reported that VulnCheck first saw attacks on CVE-2026-39808 on June 9, and that Defused confirmed them in its honeypots on June 11. Defused counted 49 exploitation events from 11 IP addresses over six days, and its CEO described "multiple independent operators on commodity infrastructure, not one campaign." Help Net Security relayed Defused's view that an exploit for one of the bugs was "vibecoded, and likely faulty." CrowdSec tracked 49 attacking IPs after releasing a detection rule on June 17. CISA added both CVEs to the KEV catalog on July 16, with a July 19 deadline. As of Oct 21, 2026, both Fortinet advisories still say "Known Exploited: No."

Who is affected#

CVE-2026-39808 affects FortiSandbox 4.4.0 through 4.4.8; 5.0 is not affected. CVE-2026-25089 affects 4.4.0 through 4.4.8, 5.0.0 through 5.0.5, and FortiSandbox Cloud and PaaS 5.0.4 through 5.0.5. Its CVE record also lists 4.2 ("all versions"), which the advisory table leaves out and for which no fix exists. The fixed releases are 4.4.9 and 5.0.6, and the 5.2 branch is not affected.

According to the CVE record, Fortinet remediated FortiSandbox Cloud itself and "customers do not need to perform any action." PaaS customers on 5.0.4 or 5.0.5 should move to 5.0.6. The CVE-2026-39808 record additionally lists older PaaS builds, 21.3.4055 through 23.4.4374, with the fix in PaaS 5.0.2.

A third April bug, CVE-2026-39813, is a JRPC API path traversal fixed in the same releases. Defused also reported attacks on it, but it is not in KEV.

Do you really need to act?#

Yes, if you are on an affected build. Both flaws work without authentication, and CISA rates them automatable with total technical impact. A working request for CVE-2026-39808 has been public since the advisory. A sandbox is a trusted part of the security stack: Defused's CEO noted that "FortiSandbox is high-value because it ingests from and connects to other Fortinet devices." Root on it gives an attacker a quiet foothold and visibility into the files your organization flags as suspicious.

Exposure still matters. The vulnerable paths are on the management web UI and API, so an appliance reachable only from a locked-down admin network is much harder to hit. Researchers saw these attacks in internet-facing honeypots, though, so any box exposed while vulnerable needs investigating, not just patching.

What to do now#

1. Record the firmware version of every FortiSandbox appliance, VM and PaaS instance from the dashboard's System Information widget.
2. Upgrade 4.4.x to 4.4.9 or later and 5.0.x to 5.0.6 or later, or move to 5.2. Move 4.2 systems to a supported branch, because there is no 4.2 fix.
3. Restrict HTTPS management access to a dedicated admin network or jump host.
4. Until you have patched, deny untrusted requests to /fortisandbox/job-detail/tracer-behavior at an upstream proxy or WAF. This covers CVE-2026-39808 only.
5. If the box was exposed while vulnerable, preserve logs and rebuild from a clean image if anything looks wrong. Rotate admin passwords and any credentials or API keys it uses to talk to other devices.

How to tell if you were hit#

Fortinet has published no indicators of compromise. CrowdSec describes the CVE-2026-39808 pattern: requests to /fortisandbox/job-detail/tracer-behavior with shell metacharacters in jid, followed by requests to /ng/<filename>.txt to confirm that output was written. Search proxy, WAF and firewall logs for both, for example grep -E 'tracer-behavior[^ ]*jid=[^ ]*(%7C|\|)' access.log. Also look for unexpected files served from the web root, outbound connections from the sandbox to unknown hosts, and new admin accounts or configuration changes. As of Oct 21, 2026, no public indicators exist for CVE-2026-25089.

Timeline#

• Apr 14, 2026 — Fortinet publishes FG-IR-26-100 (CVE-2026-39808) and fixes CVE-2026-39813 in the same releases.
• Jun 9, 2026 — Fortinet publishes FG-IR-26-141 (CVE-2026-25089). VulnCheck first observes exploitation of CVE-2026-39808.
• Jun 11, 2026 — Defused confirms exploitation of CVE-2026-39808.
• Jun 15, 2026 — Defused confirms exploitation of CVE-2026-39813.
• Jun 17, 2026 — CrowdSec releases a detection rule and sees its first exploitation attempts the same day.
• Jul 16, 2026 — CISA adds CVE-2026-39808 and CVE-2026-25089 to KEV.
• Jul 19, 2026 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2026-39808 · KEV 2026-07-16 · A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may…
• CVE-2026-25089 · KEV 2026-07-16 · A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Fortinet PSIRT — FG-IR-26-100: OS Command Injection through API endpoint (CVE-2026-39808) fortiguard.fortinet.com
2. Fortinet PSIRT — FG-IR-26-141: Second-Order OS Command Injection via JSON Input on start vnc feature (CVE-2026-25089) fortiguard.fortinet.com
3. CVE record — CVE-2026-39808 cve.org
4. CVE record — CVE-2026-25089 cve.org
5. NVD — CVE-2026-39808 nvd.nist.gov
6. NVD — CVE-2026-25089 nvd.nist.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2026-39808 cisa.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2026-25089 cisa.gov
9. Samuel de Lucas Maroto — CVE-2026-39808 proof of concept (GitHub) github.com
10. CrowdSec — CVE-2026-39808 Fortinet FortiSandbox command injection (VulnTracking report) crowdsec.net

Coverage and analysis

1. CyberScoop — Attackers hit pair of critical Fortinet vulnerabilities the vendor disclosed in April cyberscoop.com
2. Help Net Security — Attackers are exploiting FortiSandbox vulnerabilities helpnetsecurity.com