CVE-2026-39808: listed in the CISA KEV catalog CVE-2026-39808 · CVSS 9.8 CRITICAL · KEV 2026-07-16
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Is CVE-2026-39808 exploited? Listed in the CISA KEV catalog on 2026-07-16. Federal remediation due 2026-07-19. Past that date by 27 days. Public exploit code: none found in monitored sources. Public detection rules exist. Which products and versions are affected? No affected package list recorded here yet.
Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2026-39808 Primary sources What this record does not say No EPSS score. No affected package data. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-08-11.
CVE-2026-39808: listed in the CISA KEV catalog CVE-2026-39808 · CVSS 9.8 CRITICAL · KEV 2026-07-16
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Is CVE-2026-39808 exploited? Listed in the CISA KEV catalog on 2026-07-16. Federal remediation due 2026-07-19. Past that date by 27 days. Public exploit code: none found in monitored sources. Public detection rules exist. Which products and versions are affected? No affected package list recorded here yet.
Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2026-39808 Primary sources What this record does not say No EPSS score. No affected package data. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-08-11.