CVE-2026-84387 Fortinet CVE debrief

Who should care

Defenders responsible for Fortinet FortiSandbox systems should assess exposure and potential impact, and prioritize verification and mitigation efforts. This includes reviewing relevant monitoring, detection, and logs for exposed assets that need extra review. Defenders should also track exceptions, retest remediated assets, and close the item only after evidence is documented.

Why it matters

A high-severity command injection vulnerability exists in Fortinet FortiSandbox products, allowing a privileged attacker to potentially execute unauthorized code or commands. Defenders should prioritize verifying exposure and assessing potential impact.

• Potential code execution via crafted HTTP requests
• Possible unauthorized command execution
• Required verification of Fortinet FortiSandbox versions and configurations

Technical summary

The vulnerability exists in Fortinet FortiSandbox versions 5.2.0, 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, and 4.2 all versions. A privileged attacker may be able to execute unauthorized code or commands via crafted HTTP requests. This vulnerability has a high CVSS score of 7.2, indicating a high severity level. The vulnerability is described as a command injection issue in Fortinet FortiSandbox products, allowing a privileged attacker to potentially execute unauthorized code or commands. Defenders should prioritize verifying exposure and assessing potential impact.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, as the vulnerability has a high CVSS score of 7.2.

Recommended defensive actions

• Verify exposure by checking Fortinet FortiSandbox versions and configurations
• Assess potential impact on the network and systems
• Implement compensating controls to limit potential damage
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability is described as a command injection issue in Fortinet FortiSandbox products. The CVE record and NVD entry provide details on the affected versions and CVSS score. The vulnerability exists in Fortinet FortiSandbox versions 5.2.0, 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, and 4.2 all versions. A privileged attacker may be able to execute unauthorized code or commands via crafted HTTP requests. The CVE record was published on 2026-09-08T17:18:37.290Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.