CVE-2026-39808

CVE-2026-39808 2025년 11월, Fortinet의 FortiSandbox에서 인증되지 않은 공격자가 기본 OS에서 루트 권한으로 명령을 실행할 수 있는 심각한 취약점이 발견되었습니다. 이 취약점은 패치되었고 2026년 4월에 마침내 공개되었습니다. 이 취약점은 FortiSandbox 버전 4.4.0부터 4.4.8까지 영향을 줍니다. 전체 보안 권고는 여기에서 읽을 수 있습니다. 취약점 이 취약점은 /fortisandbox/job-detail/tracer-behavior 엔드포인트에 영향을 줍니다. OS 명령은 j...

Fortinet FortiSandbox - Command Injection

Fortinet FortiSandbox 4.4.0 through 4.4.8 contains a command injection caused by improper neutralization of special elements in OS commands, letting attackers execute unauthorized code or commands, exploit requires crafted input. id: CVE-2026-39808 info: name: Fortinet FortiSandbox - Command...

FortiSandbox-RCE-Exploit-CVE-2026-39808

FortiSandbox RCE 스캐너 — CVE-2026-39808 Fortinet FortiSandbox에서 인증 없이 root 권한으로 실행되는 OS 명령 주입 취약점 취약점 • 설치 • 사용법 • 작동 원리 • 파이프라인 • Shodan Dorks • 면책 조항 취약점 CVE-2026-39808 은 Fortinet FortiSandbox의 치명적인 인증 없는 OS 명령 주입 취약점입니다. /fortisandbox/job-detail/tracer-behavior API 엔드포인트가 jid 매개변수를 제대로 검증하지 않아,...

CVE-2026-39813

🛡️ CVE-2026-39813 - Уязвимость обхода пути Fortinet FortiSandbox 📌 Обзор CVE-2026-39813 — это критическая уязвимость обхода пути , затрагивающая Fortinet FortiSandbox. Уязвимость возникает из-за неправильной проверки путей к файлам, предоставленных пользователем, что позволяет злоумышленникам...

CVE-2026-25089

🚨 CVE-2026-25089 - Критическая OS Command Injection в FortiSandbox 📖 Обзор CVE-2026-25089 - это критическая уязвимость OS Command Injection CWE-78 , затрагивающая несколько развертываний Fortinet FortiSandbox. Неаутентифицированный удаленный злоумышленник может использовать эту уязвимость,...

CVE-2026-25089

CVE-2026-25089 - Черновик - Fortinet FortiSandbox ⚡ Простое использование Используйте этот проект только в безопасных и авторизованных средах, таких как: Локальные виртуальные машины Docker-контейнеры Изолированные лабораторные среды Авторизованные среды тестирования на проникновение Пример...

CVE-2026-39808

🚨 FortiSandbox 루트 샌드박스 탈출 - CVE-2026-39808 🎯 개요 이 저장소는 Fortinet FortiSandbox의 치명적인 인증 없는 명령 주입 취약점인 CVE-2026-39808 에 대한 깔끔하고 잘 문서화된 개념 증명PoC을 포함합니다. 이 취약점은 샌드박스 탈출 및 rootuid=0 권한으로 원격 코드 실행을 허용합니다. 이 PoC가 시연하는 내용: jid 매개변수를 통한 경로 탐색Path Traversal + 명령 주입Command Injection 분석 환경에서 샌드박스 탈출 root 권한으로...

CVE-2026-39808

CVE-2026-39808 Fortinet FortiSandbox 4.4.0-4.4.8 - tracer-behavior Endpoint를 통한 OS 명령 주입 Fortinet FortiSandbox는 의심스러운 파일, URL 및 네트워크 트래픽을 악성 행위에 대해 분석하기 위해 격리된 환경을 생성하는 고급 위협 방어 솔루션입니다. 정적 분석, 동적 분석, AI 기반 머신러닝, FortiGuard의 위협 인텔리전스를 결합하여 기존 시그니처 기반 방어를 우회하는 제로데이 위협, 회피형 멀웨어, 랜섬웨어, 표적 공격을 탐지합니다...

The vulnerability of the FortiSandbox threat detection and mitigation system, related to the failure to take measures to clean data at the management level, allows a perpetrator to gain unauthorized access to protected information or execute arbitrary commands.

The vulnerability of the FortiSandbox threat detection and mitigation system is related to the lack of measures taken at the management level to clean data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information or execu...

The vulnerability of the graphical user interface of Fortinet’s FortiSandbox and FortiSandbox Cloud systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the graphical user interface of Fortinet’s FortiSandbox and FortiSandbox Cloud systems relates to deficiencies in access control. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through specially...

Vulnerabilities found in Fortinet’s Forti-products

Fortinet has identified vulnerabilities in FortiAnalyzer, FortiOS, FortiPAM, FortiProxy, FortiSandbox, FortiManager, FortiManager Cloud, FortiMonitorOnSight, FortiClient Windows, FortiSIEM, and FortiSOAR. These vulnerabilities involve various types of errors in multiple Fortinet products. The mos...

Fortinet FortiSandbox write_remote_backup_to_crontab cronValue Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fortinet FortiSandbox. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of the cronValue parameter passed to the writeremotebackuptocrontab...

CVE-2026-84387

A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via...

CVE-2026-26084

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests...

CVE-2026-26084

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests...

CVE-2026-26084

Fortinet FortiSandbox is affected by an improper access control vulnerability (CVE-2026-26084) that may allow an unauthenticated, remote attacker to access sensitive information via crafted HTTP requests . Affected versions include FortiSandbox 5.0.0–5.0.5, 4.4.0–4.4.8, FortiSandbox Cloud 5.0.4–5...

EUVD-2026-72926

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests...

CVE-2026-84387

CVE-2026-84387 is a command injection vulnerability in Fortinet FortiSandbox affecting versions 5.2.0 , 5.0.0 through 5.0.6 , and 4.4.0 through 4.4.9 . The flaw involves improper neutralization of special elements in a command, potentially allowing an attacker to execute unauthorized code or comm...

CVE-2026-84387

A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via...

EUVD-2026-72922

A improper neutralization of special elements used in a command 'command injection' vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via...