CVE-2026-39808
CRITICAL EXPLOITED NUCLEIFortiSandbox 4.4.0-4.4.8 - OS Command Injection
Title source: llmExploitation Summary
CVE-2026-39808 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 6 public exploits from researchers including adminlove520, ynsmroztas, XZ1r0. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository provides a functional PoC for CVE-2026-39808, demonstrating an unauthenticated RCE vulnerability in Fortinet FortiSandbox via command injection in the `jid` parameter of the `/fortisandbox/job-detail/tracer-behavior` endpoint. The exploit uses a simple curl command to inject OS commands via the pipe symbol.
Description
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Exploits (6)
The repository provides a functional PoC for CVE-2026-39808, demonstrating an unauthenticated RCE vulnerability in Fortinet FortiSandbox via command injection in the `jid` parameter of the `/fortisandbox/job-detail/tracer-behavior` endpoint. The exploit uses a simple curl command to inject OS commands via the pipe symbol.
This repository contains a functional Python exploit for CVE-2026-39808, an unauthenticated OS command injection vulnerability in Fortinet FortiSandbox. The exploit leverages the `/fortisandbox/job-detail/tracer-behavior` endpoint with an unsanitized `jid` parameter to execute arbitrary commands as root.
The repository provides a functional PoC for CVE-2026-39808, an unauthenticated RCE vulnerability in FortiSandbox. The exploit leverages command injection via the `jid` parameter in the `/fortisandbox/job-detail/tracer-behavior` endpoint using the pipe symbol (`|`).
This repository contains a functional exploit PoC for CVE-2026-39808, demonstrating an unauthenticated OS command injection vulnerability in Fortinet FortiSandbox. The exploit chains CVE-2026-39813 (authentication bypass) with CVE-2026-39808 (command injection) to achieve root-level remote code execution.
The repository provides a functional proof-of-concept for CVE-2026-39808, demonstrating an unauthenticated command injection vulnerability in Fortinet's FortiSandbox via the `jid` parameter in the `/fortisandbox/job-detail/tracer-behavior` endpoint. The PoC uses a simple curl command to achieve remote code execution as root.
The repository claims to provide an exploit for CVE-2026-39808 but only contains a README with vague details and external download links. No actual exploit code is present, and the focus is on directing users to external sources.
Nuclei Templates (1)
http.title:"FortiSandbox"
title="FortiSandbox"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H