Critical 1 exploited CVE WID-SEC-2026-1094 6 CVEs

Fortinet FortiSandbox: Mehrere Schwachstellen

Published Apr 14, 2026 · Updated Jun 15, 2026 · Revision 3 · de-DE

Vendor: Fortinet Product: FortiSandbox

Summary

Ein Angreifer kann mehrere Schwachstellen in Fortinet FortiSandbox ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen und Code zur Ausführung zu bringen.

Product

FortiSandbox ist eine Advanced Threat Detection Appliance.

Vulnerabilities 6

Critical 9.1

CVE-2026-39808 Exploited Public exploit Scanner template EPSS 93%

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …

Fortinet FortiSandbox FortiSandbox PaaS Network devices

Apr 14, 2026
KEV Jul 16, 2026
Critical 9.1

CVE-2026-39813 Public exploit Scanner template EPSS 44%

A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4…

Fortinet FortiSandbox Network devices

Apr 14, 2026
Medium 6.2

CVE-2026-25691

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox…

Fortinet FortiSandbox FortiSandbox PaaS FortiSandbox Cloud Network devices

Apr 14, 2026
Medium 4.9

CVE-2025-61886

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerab…

Fortinet FortiSandbox FortiSandbox PaaS Network devices

Apr 14, 2026
Medium 4.3

CVE-2026-39812

A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiS…

Fortinet FortiSandbox FortiSandbox PaaS Network devices

Apr 14, 2026
Low 2.5

CVE-2026-27316

A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all…

Fortinet FortiSandbox FortiSandbox PaaS Network devices

Apr 14, 2026

Revision history

2026-06-15 #3
CVE-2026-39808 und CVE-2026-39813 werden ausgenutzt
2026-04-19 #2
PoC aufgenommen
2026-04-14 #1
Initiale Fassung

References

FortiGuard Labs PSIRT Advisory FG-IR-26-100 vom 2026-04-14
https://www.fortiguard.com/psirt/FG-IR-26-100
FortiGuard Labs PSIRT Advisory FG-IR-26-109 vom 2026-04-14
https://www.fortiguard.com/psirt/FG-IR-26-109
FortiGuard Labs PSIRT Advisory FG-IR-26-110 vom 2026-04-14
https://www.fortiguard.com/psirt/FG-IR-26-110
FortiGuard Labs PSIRT Advisory FG-IR-26-112 vom 2026-04-14
https://www.fortiguard.com/psirt/FG-IR-26-112
FortiGuard Labs PSIRT Advisory FG-IR-26-113 vom 2026-04-14
https://www.fortiguard.com/psirt/FG-IR-26-113
FortiGuard Labs PSIRT Advisory FG-IR-26-115 vom 2026-04-14
https://www.fortiguard.com/psirt/FG-IR-26-115
PoC CVE-2026-39808 vom 2026-04-20
https://github.com/samu-delucas/CVE-2026-39808
Bleeping Computer vom 2026-06-15
https://www.bleepingcomputer.com/news/security/critical-fortinet-fortisandbox-flaws-now-exploited-in-attacks/