FortiSandbox Has a Command Injection. Malware Analysis Can Become RCE
- The Mess: FortiSandbox has a command-injection flaw in its
write_remote_backup_to_crontabfunction. A privileged attacker can turn crafted input into operating-system commands. - The Damage: Compromising a FortiSandbox instance can give an attacker code execution inside infrastructure designed to inspect everyone else’s malware.
- The Fix: Upgrade affected FortiSandbox installations and remove unnecessary high-privilege access immediately.
FortiSandbox exists to inspect files that nobody trusts.
That makes a command-injection vulnerability inside the product particularly uncomfortable.
CVE-2026-84387 affects Fortinet FortiSandbox and allows an attacker to execute unauthorized commands through insufficient neutralization of special characters in command input. ZDI identifies the vulnerable function as write_remote_backup_to_crontab.
This is not an unauthenticated Internet RCE.
The attacker needs high privileges.
But once that position exists, the vulnerable function provides a direct path from application input to operating-system command execution.
The Backup Function Is the Door
The vulnerable code handles remote-backup configuration.
The problem is the classic one: data that should remain data eventually reaches a command interpreter.
An attacker who controls the relevant cronValue input can inject additional shell commands instead of supplying only the expected scheduling value. ZDI classifies the issue as a command injection remote-code-execution vulnerability.
That is a bad place to make assumptions about input safety.
Especially inside a security appliance.
CVSS 7.2 — High, Not Critical
ZDI rates CVE-2026-84387:
CVSS 3.1: 7.2
Vector:
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The important field is PR:H.
The attacker needs a highly privileged account.
That significantly changes the threat model compared with the unauthenticated FortiSandbox RCEs that have appeared earlier this year.
Still, once an attacker has that level of access, command execution with high confidentiality, integrity and availability impact is a serious escalation.
A Security Appliance Should Not Become the Payload
FortiSandbox is not an ordinary application server.
It sits in the security pipeline and processes potentially hostile content. Depending on the deployment, it can interact with malware submissions, network infrastructure, storage and administrative systems.
Compromising the appliance therefore gives an attacker an interesting platform.
The irony is obvious:
the machine built to analyze malware can itself become part of the attack chain.
And unlike a workstation, security infrastructure tends to have access to things attackers actually care about.
Affected FortiSandbox Versions
CVE-2026-84387 affects:
- FortiSandbox 5.2.0
- FortiSandbox 5.0.0 through 5.0.6
- FortiSandbox 4.4.0 through 4.4.9
The CVE record identifies the affected product and versions, while Fortinet’s current documentation shows the 5.2.1 release line.
Administrators should:
- upgrade affected FortiSandbox systems;
- remove unnecessary high-privilege accounts;
- audit administrators with access to backup configuration;
- inspect cron and backup configuration for unexpected changes;
- review command-execution and administrative logs;
- restrict management interfaces to trusted networks.
This Is Not the First FortiSandbox Problem
The timing is worth noting.
FortiSandbox has accumulated multiple security vulnerabilities this year, including previous command-injection and access-control issues. The broader Fortinet vulnerability feed lists several FortiSandbox vulnerabilities with significantly higher scores, including earlier 9.8 and 9.1 command-injection issues.
That makes patch management more important than treating CVE-2026-84387 as an isolated defect.
Security appliances need security maintenance too.
Bugstoday Opinion
A command injection in a malware-analysis appliance is almost poetic.
You build a box specifically to execute suspicious things safely.
Then a backup parameter becomes a shell.
CVE-2026-84387 is not the easiest FortiSandbox vulnerability to exploit because the attacker already needs high privileges. But that does not make the bug irrelevant.
If somebody already owns the administrator account, you don’t want to give them a second way to own the box.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
TrendAI Zero Day Initiative — ZDI-26-645
CVE-2026-84387
Fortinet FortiSandbox Documentation
Fortinet Security Advisories
