CVE-2026-84387: Fortinet FortiSandbox Command Injection RCE

CVE-2026-84387 Overview

CVE-2026-84387 is a command injection vulnerability affecting multiple versions of Fortinet FortiSandbox. The flaw stems from improper neutralization of special elements used in a command [CWE-77]. An authenticated attacker with high privileges can leverage the weakness to execute unauthorized code or commands over the network. Fortinet documented the issue in advisory FG-IR-26-167.

Critical Impact
Successful exploitation allows an authenticated remote attacker to execute arbitrary commands on the FortiSandbox appliance, compromising confidentiality, integrity, and availability of the malware analysis platform.

Affected Products

Fortinet FortiSandbox 5.2.0
Fortinet FortiSandbox 5.0.0 through 5.0.6
Fortinet FortiSandbox 4.4.0 through 4.4.9

Discovery Timeline

2026-09-08 - CVE-2026-84387 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-84387

Vulnerability Analysis

CVE-2026-84387 is classified as a command injection weakness under CWE-77. FortiSandbox fails to properly neutralize special characters passed into a command construction routine. An authenticated attacker with high privileges can inject shell metacharacters that the underlying system interprets as separate commands. The flaw affects the sandbox appliance itself, which is typically deployed to detonate and analyze suspicious files in isolated environments.

Because FortiSandbox integrates with FortiGate, FortiMail, and other Fortinet products, a compromised appliance can undermine downstream detection pipelines. Attackers who gain code execution may tamper with analysis verdicts, exfiltrate malware samples, or pivot into adjacent management networks.

Root Cause

The root cause is missing or insufficient input sanitization when the application constructs operating system commands from user-controlled input. When special elements such as shell metacharacters (;, |, &, backticks, $()) reach the command interpreter without escaping, the interpreter treats them as command delimiters instead of literal data.

Attack Vector

The attack vector is network-based and requires the attacker to already hold high-privilege credentials on the FortiSandbox management interface. No user interaction is required, and the attack complexity is low once authentication is achieved. Fortinet's advisory FG-IR-26-167 documents the affected feature area. Refer to the Fortinet PSIRT Advisory FG-IR-26-167 for vendor-supplied technical details.

No verified proof-of-concept code is publicly available at the time of publication. The vulnerability mechanism follows the standard command injection pattern where crafted input containing shell delimiters escapes the intended command context and appends attacker-controlled operating system instructions.

Detection Methods for CVE-2026-84387

Indicators of Compromise

Unexpected shell processes spawned by FortiSandbox service accounts, particularly /bin/sh or /bin/bash children of web management daemons.
Outbound network connections from the FortiSandbox appliance to unfamiliar destinations that do not match sample-detonation traffic patterns.
Modifications to configuration files, cron entries, or startup scripts on the appliance that do not align with change-management records.

Detection Strategies

Audit administrative session logs for high-privilege accounts issuing requests that contain shell metacharacters such as ;, |, backticks, or $().
Correlate FortiSandbox syslog output with authentication events to identify command execution activity that follows privileged logins from unusual source addresses.
Baseline normal appliance behavior and alert on deviations in process trees, outbound connections, or file integrity.

Monitoring Recommendations

Forward FortiSandbox audit and system logs to a centralized SIEM for retention and correlation with network telemetry.
Monitor management-plane access to the FortiSandbox web UI and API, restricting source addresses to known administrative hosts.
Enable file integrity monitoring on appliance configuration directories where supported by the platform.

How to Mitigate CVE-2026-84387

Immediate Actions Required

Inventory all FortiSandbox appliances and identify instances running versions 5.2.0, 5.0.0 through 5.0.6, or 4.4.0 through 4.4.9.
Restrict administrative access to the FortiSandbox management interface to a dedicated management network and trusted jump hosts.
Rotate credentials for all high-privilege FortiSandbox accounts and enforce multi-factor authentication where supported.

Patch Information

Fortinet has published advisory FG-IR-26-167 describing the vulnerability and remediation guidance. Administrators should consult the Fortinet PSIRT Advisory FG-IR-26-167 for the fixed release versions applicable to each affected branch and apply the corresponding upgrade path.

Workarounds

Limit administrative access to the FortiSandbox appliance to a small set of authorized operators and audit account membership.
Segment the FortiSandbox management interface behind a firewall that only permits traffic from a dedicated administration VLAN.
Disable or remove unused administrative accounts to reduce the attack surface available to credential-based exploitation.

bash

# Example: restrict management access using trusted hosts on FortiSandbox CLI
config system admin
  edit "admin"
    set trusthost1 10.10.10.0 255.255.255.0
  next
end