Fortinet PSIRT Monthly Advisories — April 2026

Exploited 2

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

• Critical 9.1
  CVE-2026-39808 Exploited Public exploit Scanner template A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may all…
  EPSS 93%
• Medium 5.4
  CVE-2025-61624 Exploited An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0…
  EPSS 1.3%

Critical 1

• Critical 9.1
  CVE-2026-39813 Public exploit A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of…
  EPSS 22%

All vulnerabilities 27