FortiSandbox
CVE-2026-84387: Command injection in FortiSandbox
A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| FortiSandbox 5.2 | 5.2.1 or later |
| FortiSandbox 5.0.0 to 5.0.6 | 5.0.7 or later |
| FortiSandbox 4.4.0 to 4.4.9 | 4.4.10 (upcoming) or later |
| FortiSandbox 4.2.1 to 4.2.8 | Upgrade past 4.2.8; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 10 Oct 2026.