Is CVE-2026-39813 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39813 being exploited in the wild.

How severe is CVE-2026-39813?

Critical severity, with a CVSS score of 9.8, published 14 April 2026.

Which products and versions are affected?

Fortinet FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8; Fortinet Fortisandbox Cloud 23.4, 24.1, 5.0.4 through 5.0.5.

Is there a fix for CVE-2026-39813?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-39813 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-39813?

Check whether you run Fortinet FortiSandbox or Fortinet Fortisandbox Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39813: Fortinet FortiSandbox privilege escalation in JRPC API

CVE-2026-39813 · Severity: critical · CVSS 9.8 · Published 2026-04-14

Fortinet FortiSandbox, a security tool used to identify and isolate advanced threats, contains a critical vulnerability in its programming interface. An attacker can exploit this flaw to bypass security checks and gain unauthorized administrative control over the system. This could allow an attacker to disrupt security operations or access sensitive data processed by the sandbox environment.

Technologies: Fortinet FortiSandbox, Fortinet Fortisandbox Cloud. Vendors: Fortinet.

Quick answers

Is CVE-2026-39813 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39813 being exploited in the wild.
How severe is CVE-2026-39813?: Critical severity, with a CVSS score of 9.8, published 14 April 2026.
Which products and versions are affected?: Fortinet FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8; Fortinet Fortisandbox Cloud 23.4, 24.1, 5.0.4 through 5.0.5.
Is there a fix for CVE-2026-39813?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-39813 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39813?: Check whether you run Fortinet FortiSandbox or Fortinet Fortisandbox Cloud at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-24) exists in the JRPC API component of Fortinet FortiSandbox. The flaw is caused by improper validation of '../filedir' sequences in HTTP requests, which allows an unauthenticated remote attacker to bypass authentication mechanisms. Successful exploitation enables the attacker to achieve full privilege escalation on the device. The vulnerability affects FortiSandbox versions 5.0.0-5.0.5 and 4.4.0-4.4.8, as well as specific versions of FortiSandbox Cloud. Users are advised to upgrade to versions 5.0.6 or 4.4.9 respectively.

Affected products

Fortinet FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8
Fortinet FortiSandbox Cloud 23.4, 24.1, 5.0.4 through 5.0.5

Timeline

2026-04-14: disclosed: Initial publication of the advisory by Fortinet.
2026-04-14: advisory: NVD entry created.
2026-06-18: other: Last modified date for the CVE record.

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-112

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.