CISA confirmó el 16.07.2026 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 19.07.2026.
Acción requerida: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. https://fortiguard.fortinet.com/psirt/FG-IR-26-100 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-39808
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Fortinet | FortiSandbox | 4.4.0 – ≤ 4.4.8 | |
| Fortinet | FortiSandbox PaaS | 23.4.4374, 23.4.4350, 23.3.4329, 23.1.4245, 22.2.4151, 22.2.4134, 22.1.4113, 21.4.4072, 21.3.4055 | |
| fortinet | fortisandboxpaas | 23.4.4374 |
cpe:2.3:a:fortinet:fortisandbox:*:*:*:*:*:*:*:* ≥ 4.4.0 ≤ 4.4.9Nuestro sensor honeypot gratuito y de código abierto espera en puertos que su servidor no usa y reporta a una lista compartida los escáneres y atacantes que se conectan.