CVE-2026-84387: Fortinet Cron Job Injection in Remote Backup
This Fortinet advisory covers CVE-2026-84387 in FortiSandbox.
Key facts
- Vendor rating
- Medium, CVSS 6.7
- CISA KEV
- Not listed (catalogue checked )
- Affected
- FortiSandbox FortiSandbox: 4.4 through 5.2 (vendor-listed versions)
- Advisory id
- FG-IR-26-167
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
CVSSv3 Score:
6.7
An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] in FortiSandbox may allow a privileged attacker to execute unauthorized code or commands via crafted HTTP requests.
Revised on 2026-09-08 00:00:00
Text from the source record.
- FortiSandbox FortiSandbox: 4.4 through 5.2 (vendor-listed versions)
Official advisory · high-confidence parse· fetched ·verify at source
CVE-2026-84387 in other vendors' advisories
- Fortinet: CVE-2026-84387, high severity
More Fortinet advisories
CVE-2026-106170Oct 13, 2026Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0CVE-2026-106170Oct 13, 2026Persistent Denial of Service in Admin ProfileCVE-2026-59835Jul 14, 2026Unauthenticated VNC access exposed on all interfacesCVE-2026-39813Apr 14, 2026Unauthenticated Authentication bypass and Privilege escalation in FortiSandboxCVE-2025-67685Jan 13, 2026Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in FortinetCVE-2026-98432Nov 2, 2026Linux kernel RCE CVE-2026-98432
Get an email when Fortinet publishes the next one.
See Fortinet's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Fortinet CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
