PoC Exploit Released for FortiSandbox Vulnerability that Allows Attacker to Execute Commands

A public proof-of-concept exploit for CVE-2026-39808 enables unauthenticated OS command injection and remote code execution as root against Fortinet FortiSandbox (versions 4.4.0–4.4.8) via the /fortisandbox/job-detail/tracer-behavior endpoint; Fortinet released a patch and advisory (FG-IR-26-100) and organizations are urged to patch, audit exposed instances, review logs for suspicious GET requests to the endpoint, and restrict access to management interfaces.