FortiSandbox Command Injection (CVE‑2026‑84387) Enables Remote Code Execution

ZDI-26-645: Fortinet FortiSandbox write_remote_backup_to_crontab Command Injection (CVE‑2026‑84387) Enables Remote Code Execution

What It Is — Fortinet FortiSandbox contains a command‑injection flaw in the write_remote_backup_to_crontab API. An authenticated attacker can supply a crafted cronValue string that is passed unchecked to a system call, resulting in arbitrary code execution with root privileges.

Exploitability — The vulnerability is remotely exploitable once valid credentials are obtained; a proof‑of‑concept exists and the CVSS base score is 7.2 (High). No public exploit‑as‑a‑service is known, but the attack path is straightforward.

Affected Products — FortiSandbox (all versions prior to the September 2026 security update).

Why It Matters for Trust & Control Assurance

• Input‑validation & secure configuration – The flaw highlights a gap in controls that ensure only sanitized data reaches privileged system components, a core control objective across most frameworks.
• Audit‑ready evidence – Demonstrating that the “validate input before execution” control is enforced requires continuous monitoring logs and configuration baselines that can be presented during audits.
• Defensible risk posture – Enterprises that can prove they have automated checks for unsafe API parameters are better positioned to satisfy regulators and demanding customers.

Recommended Actions

1. Apply Fortinet’s September 2026 patch (FG‑IR‑26‑167) immediately.
2. Conduct a focused review of all custom API endpoints for proper input sanitization and least‑privilege execution.
3. Enable detailed logging of API calls to the write_remote_backup_to_crontab endpoint and integrate logs into a centralized SIEM for continuous monitoring.
4. Update your control‑mapping repository to reflect the remediation and capture evidence for audit purposes.

Source: Zero Day Initiative advisory – ZDI‑26‑645