9.1 CriticalCWE-24
CVE-2026-39813
Fortinet FortiSandbox vulnerability
FortinetFortiSandbox
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
22%probability of exploitation in the next 30 days
Higher than 98% of scored CVEs
SeverityCVSS
9.1Critical
Description NVD
A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via specially crafted HTTP requests.
Coverage 5 articles · 4 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 15 Apr · 09:56 UTC | SecurityWeek | Fortinet patches critical FortiSandbox flaws and high risk Cloud bugs |
| Wed 15 Apr · 14:04 UTC | The Hacker News | Exploiters target SAP SQLi and Adobe zero day flaws in April |
| Tue 16 Jun · 14:28 UTC | Security Affairs | Fortinet warns of active exploits in unpatched FortiSandbox flaws |
| Wed 17 Jun · 07:21 UTC | SecurityWeek | 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs |
| Wed 17 Jun · 13:11 UTC | SOCRadar | FortiSandbox CVE-2026-39813 lets hackers bypass auth, run code |
- FortiSandbox CVE-2026-39813 lets hackers bypass auth, run codeSOCRadar
- 3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker CrosshairsSecurityWeek · mentions it in passing
- Fortinet warns of active exploits in unpatched FortiSandbox flawsSecurity Affairs
- Exploiters target SAP SQLi and Adobe zero day flaws in AprilThe Hacker News · mentions it in passing
- Fortinet patches critical FortiSandbox flaws and high risk Cloud bugsSecurityWeek · first in our coverage