CVE-2026-39812

Published Apr 14, 2026

Last updated 9 days ago

Overview

Description
A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.5, FortiSandbox PaaS 4.4.0 through 4.4.8, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Source
psirt@fortinet.com
NVD status
Analyzed
Products
fortisandbox, fortisandbox_cloud

Risk scores

CVSS 3.1

Type
Secondary
Base score
4.8
Impact score
2.7
Exploitability score
1.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Severity
MEDIUM

Weaknesses

psirt@fortinet.com
CWE-79

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.