CVE-2026-39813
Serial number: AV26-351 Date: April 14, 2026 Updated: July 16, 2026 On April 14, 2026, Fortinet published security advisories to address vulnerabilities in multiple products. Included were critical updates for the following: FortiSandbox 4.4 – versions 4.4.0 to 4.4.8 FortiSandbox 5.0 – versions 5.0.0 to 5.0.5 FortiAnalyzer Cloud 7.6 – versions 7.6.2 to 7.6.4 FortiManager Cloud 7.6 – versions 7.6.2 to 7.6.4 FortiDDoS-F 7.2 – versions 7.2.1 to 7.2.2 Update 1 Open-source reporting indicates that CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089 have been exploited. Update 2 On July 16, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-39808 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates. OS Command Injection through API endpoint Unauthenticated Authentication bypass and Privilege escalation in FortiSandbox Heap-based buffer overflow in oftpd daemon SQL Injection via API Fortinet PSIRT Advisories CISA KEV : CVE-2026-39808
CSIRTS triage
- What
- There is an OS command injection vulnerability that allows unauthenticated attackers to execute unauthorized commands.
- Who is affected
- Users of FortiSandbox versions 4.4.0 to 4.4.8 and 5.0.0 to 5.0.5.
- Urgency
- Remediation is urgent due to confirmed exploitation of the vulnerability.
- Action
- Apply the necessary updates as recommended by Fortinet.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-39813
Get an email if CVE-2026-39813 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Elevated exploitation risk23.1% 30-day exploitation probability — well above the norm. Schedule remediation this cycle. Riskier than 98% of all EPSS-scored CVEs.
Advisory coverage (2)
- criticalexploitedFortinet security advisory (AV26-351) – Update 2cccs · 2026-07-16
- unknownUnauthenticated Authentication bypass and Privilege escalation in FortiSandboxfortinet · 2026-04-14
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-39813)