{"id":12219,"date":"2026-04-18T10:03:37","date_gmt":"2026-04-18T10:03:37","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/04\/18\/poc-exploit-released-for-fortisandbox-vulnerability-that-allows-attacker-to-execute-commands\/"},"modified":"2026-04-18T10:03:37","modified_gmt":"2026-04-18T10:03:37","slug":"poc-exploit-released-for-fortisandbox-vulnerability-that-allows-attacker-to-execute-commands","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/04\/18\/poc-exploit-released-for-fortisandbox-vulnerability-that-allows-attacker-to-execute-commands\/","title":{"rendered":"PoC Exploit Released for FortiSandbox Vulnerability that Allows Attacker to Execute Commands"},"content":{"rendered":"

PoC Exploit Released for FortiSandbox Vulnerability that Allows Attacker to Execute Commands
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A proof-of-concept (PoC) exploit has been publicly released for a critical vulnerability in Fortinet\u2019s FortiSandbox product, tracked as\u00a0CVE-2026-39808.<\/p>\n

The flaw allows an unauthenticated attacker to execute arbitrary operating system commands as root,<\/a> the highest privilege level, without requiring any login credentials.<\/p>\n

The vulnerability was originally discovered in\u00a0November 2025\u00a0and has now been made public following Fortinet\u2019s patch release in\u00a0April 2026.<\/p>\n

Security researchers and defenders are urged to apply the fix immediately, as a working exploit is now freely available on GitHub.<\/p>\n

CVE-2026-39808 is an\u00a0OS command injection vulnerability<\/a>\u00a0affecting Fortinet\u2019s FortiSandbox, a widely used sandboxing solution designed to detect and analyze advanced threats and malware. The flaw resides in the\u00a0\/fortisandbox\/job-detail\/tracer-behavior<\/code>\u00a0endpoint.<\/p>\n

How Simple Is the Attack?<\/strong><\/h2>\n

An attacker can inject malicious operating system commands through the\u00a0jid<\/code>\u00a0GET parameter by using the\u00a0pipe symbol (|)<\/code> a common technique used to chain commands in Unix-based systems<\/a>.<\/p>\n

\"OS
OS command injection via |<\/code> in the jid parameter(source : GitHub)<\/figcaption><\/figure>\n

Because the vulnerable endpoint fails to properly sanitize user input, the injected commands are executed directly by the underlying operating system with root-level privileges.<\/p>\n

FortiSandbox versions\u00a04.4.0 through 4.4.8\u00a0are confirmed to be affected by this vulnerability.<\/p>\n

What makes CVE-2026-39808 especially alarming is how easy it is to exploit.<\/p>\n

According to researcher\u00a0samu-delucas, who published the PoC on GitHub<\/a>, a single\u00a0curl\u00a0command is enough to achieve\u00a0unauthenticated remote code execution (RCE) as root:<\/p>\n

curl -s -k --get \"http:\/\/$HOST\/fortisandbox\/job-detail\/tracer-behavior\" --data-urlencode \"jid=|(id > \/web\/ng\/out.txt)|\"<\/code><\/p>\n

In this example, the attacker redirects command output to a file stored in the web root, which can then be retrieved through a browser.<\/p>\n

This means an attacker could read sensitive files, drop malware, or fully compromise the host system <\/a>all without ever logging in.<\/p>\n

Fortinet\u2019s Response<\/strong><\/h2>\n

Fortinet patched the vulnerability <\/a>and published its official advisory under\u00a0FG-IR-26-100\u00a0through its FortiGuard PSIRT portal.<\/p>\n

The advisory confirms the severity of the flaw and outlines affected versions. Organizations running FortiSandbox 4.4.0 through 4.4.8 should upgrade to a patched version without delay.<\/p>\n