ZDI-26-645: Fortinet FortiSandbox write_remote_backup_to_crontab cronValue Command Injection Remote Code Execution Vulnerability
ZDI publishes ZDI-26-645 for CVE-2026-84387, an authenticated command injection RCE in Fortinet FortiSandbox via crontab backup, rated CVSS 7.2.
Zero Day Initiative published advisory ZDI-26-645 describing a command injection flaw in Fortinet FortiSandbox's write_remote_backup_to_crontab function. Remote authenticated attackers can execute arbitrary code through the cronValue parameter. ZDI rated the issue CVSS 7.2 and assigned CVE-2026-84387.
- Command injection via cronValue in the crontab backup function
- Authentication is required to exploit the flaw
- CVSS 7.2; tracked as CVE-2026-84387
- CVEs
- CVE-2026-84387
- Vendors
- Fortinet
- Products
- FortiSandbox
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84387 | High-Privilege Command Injection in Fortinet FortiSandbox | 7.2 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fortinet FortiSandbox. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.