Vulnerability · Published Apr 14, 2026 · Assigned by fortinet
CVE-2026-39813
Critical 9.1
In plain English
A critical-severity security flaw in FortiSandbox from Fortinet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 22.2% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)22.2%top 2.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via specially crafted HTTP requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Fortinet | FortiSandbox | 5.0.0 – through 5.0.54.4.0 – through 4.4.8 |
| Fortinet | FortiSandbox Cloud | 24.123.45.0.4 – through 5.0.5 |
Weakness: CWE-24 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C