CVE-2026-39813
Fortinet Fortisandbox 4.4.0 – 4.4.9
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-39813 is a critical-severity Path Traversal: '../filedir' (CWE-24) vulnerability in Fortinet Fortisandbox. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-39813 is a path traversal vulnerability (CWE-24) in Fortinet FortiSandbox versions 5.0.0 through 5.0.5 and 4.4.0 through 4.4.8. Published on 2026-04-14, the issue involves '../filedir' sequences and may allow an attacker to achieve escalation of privilege via an unspecified attack vector. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H), marking it as critical due to its high potential impact on confidentiality, integrity, and availability.
The vulnerability can be exploited by a remote, unauthenticated attacker over the network with low attack complexity and no user interaction required. Successful exploitation enables privilege escalation, allowing the attacker to gain elevated access on the affected FortiSandbox instance.
Fortinet's PSIRT advisory (FG-IR-26-112) at https://fortiguard.fortinet.com/psirt/FG-IR-26-112 provides further details on the vulnerability, including recommended mitigations and patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22344
Vulnerability Data
A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via <insert attack vector here>
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly neutralizes '../' sequences in externally-supplied pathnames before they are resolved.
Enforced access authorizations can limit the damage even when path traversal succeeds.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and path sanitization that prevent ../ traversal.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards require neutralizing ../ sequences and canonicalizing paths before file operations.
Security testing in development catches path-traversal flaws before release.
Secure SDLC mandates input validation and path canonicalization that directly block ../ traversal.
Application security requirements explicitly call for controls against path traversal in file-handling functions.
Secure architecture principles reduce attack surface but do not prescribe the specific coding fix.
Information access restriction limits which files can be reached, mitigating impact of traversal.