CVE-2026-39812
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A cross-site scripting vulnerability in Fortinet FortiSandbox (versions 5.0.0-5.0.5, 4.4.0-4.4.8, 4.2 all) and FortiSandbox PaaS arises from improper neutralization of input during web page generation. This may allow an attacker to execute unauthorized code or commands.
Risk Assessment
The vulnerability could enable an attacker to execute malicious code in a user's browser or application context, potentially leading to data theft or further compromise. It affects confidentiality and integrity.
Recommendation
Update FortiSandbox and FortiSandbox PaaS to the latest patched version. Consider implementing additional input validation and XSS protections.
Other vulnerabilities in FortiSandbox
See all- CVE-2026-107656Critical
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, 4.4 all versions, and 4.2 all versions may allow an attacker to execute unauthorized code or commands via crafted HTTP requests.
- CVE-2026-25089CriticalActively exploited
An OS command injection vulnerability in Fortinet FortiSandbox (versions 5.0.0-5.0.5, 4.4.0-4.4.8, 4.2 all, FortiSandbox Cloud 5.0.4-5.0.5, FortiSandbox PaaS 5.0.4-5.0.5). An unauthenticated attacker can execute unauthorized commands via crafted HTTP requests.
- CVE-2026-26083Critical
A missing authorization vulnerability in Fortinet FortiSandbox allows an unauthenticated attacker to execute unauthorized code or commands via HTTP requests. The issue affects multiple versions of FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS.
- CVE-2026-39808CriticalActively exploited
An OS command injection vulnerability has been discovered in Fortinet FortiSandbox versions 4.4.0 through 4.4.8. This flaw is due to improper neutralization of special elements used in OS commands.
- CVE-2025-53949High
An OS Command Injection vulnerability in Fortinet FortiSandbox versions 5.0.0 through 5.0.2, 4.4.0 through 4.4.7, 4.2 all versions, and 4.0 all versions may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests.
- CVE-2026-106172Medium
A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox (including Cloud versions) may allow an attacker to escalate privileges via specially crafted HTTP requests.
- CVE-2026-106170Medium
An Uncaught Exception vulnerability [CWE-248] in Fortinet FortiSandbox may allow a privileged attacker to persistently deny access to the GUI and CLI via crafted HTTP requests.
- CVE-2026-84387High
Fortinet FortiSandbox contains a command injection vulnerability (CWE-77) due to improper neutralization of special elements used in commands. A privileged attacker may execute unauthorized code or commands via crafted HTTP requests. The vulnerability affects versions 5.2.0, 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, and all 4.2 versions.
- CVE-2026-59835High
A vulnerability in Fortinet FortiSandbox versions 5.0.0-5.0.2 and 4.4.3-4.4.8 allows an unauthenticated attacker to access the VNC server of scanning VMs. The issue is due to improper resource access restrictions.
- CVE-2026-27316Low
Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, and FortiSandbox PaaS 5.0.1 through 5.0.5 contain an insufficiently protected credentials vulnerability. An authenticated administrator may read LDAP server credentials via client-side inspection.
Original NVD description (English source)
A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.5, FortiSandbox PaaS 4.4.0 through 4.4.8, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Vulnerability data from NVD (NIST) · CISA KEV · EPSS