Skip to main content
عربي
logo

NCSC-VD-2607-002-03

Severity Level: Critical

Reference No.: NCSC-VD-2607-002-03

Fortinet

Description

CVE-2026-39808: OS command injection in FortiSandbox 4.4.0–4.4.8 can allow an attacker to execute unauthorized code or system commands.

CVE-2026-25089: OS command injection allows an unauthenticated attacker to execute unauthorized commands using crafted HTTP requests. FortiSandbox 5.0.0–5.0.5, 4.4.0–4.4.8 and 4.2 are affected.

Organizations should upgrade to the latest fixed versions provided by Fortinet and verify that the updates have been applied successfully.

Vulnerabilities

  • CVE-2026-39808

    OS command injection in FortiSandbox 4.4.0–4.4.8 can allow an attacker to execute unauthorized code or system commands.

  • CVE-2026-25089

    OS command injection allows an unauthenticated attacker to execute unauthorized commands using crafted HTTP requests. FortiSandbox 5.0.0–5.0.5, 4.4.0–4.4.8 and 4.2 are affected.

References