6.7
MediumCVSS 3.1 · from fortinet
CVE-2026-84387
An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6,…
FortiSandbox · Command injection · CWE-77AffectedFortiSandbox
FixNo fix listed yet.
PublishedSep 8, 16:41 · fortinet
ScoredSep 8 · 6.7 · fortinet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions may allow a privileged attacker to execute unauthorized code or commands via crafted HTTP requests.
From fortinet
Affected and fixed versions
ProductAffectedFixed inFortiSandbox5.2.0–FortiSandbox5.0.0 – 5.0.6–FortiSandbox4.4.0 – 4.4.9–FortiSandbox4.2.1 – 4.2.8–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known