Threat Intelligence Report — CVE-2026-84387

Executive Summary

CVE-2026-84387 is a command injection vulnerability (CWE-77) affecting Fortinet FortiSandbox appliance versions 4.4.0 through 4.4.9, 5.0.0 through 5.0.6, and 5.2.0. The flaw results from improper neutralization of special elements used in an OS command, allowing an authenticated attacker with high privileges to execute arbitrary operating system commands on the underlying appliance. Successful exploitation provides complete compromise of the FortiSandbox host (Confidentiality, Integrity, and Availability impact are all rated High in the CVSS vector), which is particularly dangerous because FortiSandbox appliances are typically positioned at network inspection chokepoints and hold detonation results, malware samples, and internal network telemetry. As of this report, no patch, vendor advisory, or public exploit code has been identified; the vulnerability is considered unpatched across all listed version branches.

Note on accuracy: The NVD description for this CVE contains a placeholder ("<insert attack vector here>") rather than a concrete description of the vulnerable endpoint or parameter. The analysis below is therefore grounded in the vulnerability class (command injection) and the CVSS vector provided, without fabricating specific implementation details, function names, or URL paths.

Technical Analysis

Vulnerability Class — Command Injection (CWE-77). The root cause is the application's failure to sanitize or properly neutralize special shell metacharacters before incorporating user-influenced input into an operating system command. When an application builds a command string containing untrusted data and passes it to a shell or a command executor (such as system(), exec(), popen(), or equivalent), an attacker can terminate the intended command and append arbitrary instructions using characters such as ;, &&, |, `, or $(...).

Affected component surface — per CVSS vector inference. The vector AV:N/AC:L/PR:H/UI:N indicates the vulnerable code path is reachable over the network without user interaction, but requires the attacker to already hold high-privileged credentials (e.g., an administrator account on the FortiSandbox management interface or API). The absence of S scope (U:Unchanged) means the injected command executes within the security context of the vulnerable application process and does not cross an explicit trust boundary — however, because FortiSandbox runs on a dedicated host OS, command injection with high privileges typically maps to full host-level code execution. FortiSandbox management functionality exposed via HTTPS (typically TCP/443 and the admin web UI / API) is the plausible attack surface given the network root and high privilege requirement; however, insufficient technical detail is available in the NVD description to confirm the exact handler, parameter, or management function.

Affected versions and patch status. The following ranges are implicated:

• FortiSandbox 4.4.0 through 4.4.9
• FortiSandbox 5.0.0 through 5.0.6
• FortiSandbox 5.2.0

Patch confidence is 0/4 (UNPATCHED): no vendor security advisory (e.g. a Fortinet PSIRT bulletin), firmware update, hotfix, or changelog entry was found in any tracked source. Affected-version data was not provided as a structured list, but the NVD description names the three branches above. FortiSandbox 5.1.x is not listed in the description; it is plausible that the 5.2.0 branch is current, with 5.1 branch either not affected or simply not named — this remains unconfirmed.

Attack mechanism at class level. A high-privileged remote user submits crafted input to a management function on the appliance that internally constructs a shell command (e.g., for system diagnostics, quarantine file handling, policy updates, or log export). Because shell metacharacters are not neutralized, the input breaks out of the intended command context and executes attacker-controlled instructions with the privileges of the FortiSandbox service (typically root on the appliance OS). Since no endpoint or parameter names are disclosed in the description, the precise injection sink cannot be enumerated here; analysis of the vulnerable function within the named firmware versions is required once vendor details are published.

Exploitation Scenarios

No public PoC or exploit code exists for CVE-2026-84387 at the time of writing. The attack chain below is inferred from the vulnerability class (CWE-77 command injection) and the CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). It is presented as a scenario model rather than a step-by-step replication guide.

Step 1 — Reconnaissance and target identification. An attacker with knowledge of an organization's network architecture (or who has already compromised a low-privilege administrative account) identifies a FortiSandbox appliance via banner grabbing, Shodan-style network scanning (product:"FortiSandbox", HTTPS on 443), or internal network discovery. FortiSandbox is commonly deployed inline or in "tap" mode alongside FortiGate firewalls and mail gateways, so it is reachable from the management network and sometimes from less-restricted segments. The attacker authenticates to the management interface or API with high-privilege credentials (default administrative accounts with weak passwords, or credentials harvested from earlier phishing/breach of an admin workstation are plausible initial footholds).

Step 2 — Flaw triggering. Once authenticated, the attacker submits specifically crafted input — containing shell metacharacters such as ;, |, &&, or backticks — to a management function that the application passes, unsanitized, into a system command. The exact input field is unnamed in public documentation, but based on the class, likely candidates include fields that feed into commands for archive extraction, URL reputation lookups, sample detonation jobs, or system-level utilities executed by the appliance. The attacker terminates the intended command context and injects an additional command payload.

Step 3 — Payload execution. The injected command executes with the privileges of the FortiSandbox daemon (typically root). Example payload classes: (a) spawning a reverse shell to an attacker-controlled host; (b) writing an SSH authorized_key entry to establish persistent remote access; (c) downloading and executing a second-stage implant via wget/curl; (d) creating a backdoor user account; or (e) exfiltrating local databases and configuration files. Because the injection is evaluated by the shell, command chaining allows multiple operations in a single request.

Step 4 — Post-exploitation impact.

• Confidentiality (C:H): access to the appliance filesystem, configuration (including integration credentials for FortiGate, Active Directory, and mail servers), sandbox detonation logs containing submitted files, and any data captured during dynamic analysis (e.g., decrypted traffic or credentials from analyzed malware).
• Integrity (I:H): ability to modify sandboxing policies, whitelist malicious hashes, poison detonation results, or tamper with logs to cover forensic traces.
• Availability (A:H): the attacker may render the sandbox inoperable, corrupt its OS, or use the host as a pivot for lateral movement into adjacent security infrastructure.

Because FortiSandbox often has elevated trust and connectivity into internal networks for submission/reporting purposes, full host compromise enables lateral movement into the broader environment.

Impact Assessment

The High confidentiality, integrity, and availability subscores reflect that successful exploitation yields essentially complete control of the appliance's host OS with no residual integrity of the sandbox environment. Importantly, the high privilege requirement (PR:H) raises the bar for external attackers, but for organizations whose FortiSandbox admin credentials have been exposed via prior breach or weak password practices, this bar is frequently low in practice.

Detection Guidance

The following detection content targets the exploitation of command injection against FortiSandbox. Because no public exploit samples exist and no specific endpoint is disclosed, the rules are built around generic command-injection indicators: unusual shell metacharacters in HTTP request parameters, long URL query strings, and subsequent outbound traffic consistent with reverse shells or implant downloads.

Sigma Rule

title: FortiSandbox Command Injection Attempt (CVE-2026-84387)
id: a7f3d2c1-9e4b-4c6a-8b1d-3e2f4a5b6c7d
status: experimental
description: Detects HTTP requests to FortiSandbox management interfaces containing shell metacharacters indicative of command injection attempts
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84387
author: Valters IT Security Research
date: 2026/01/01
logsource:
  category: webserver
  product: fortinet
  service: fortisandbox
detection:
  selection_uri:
    cs-uri-query|contains:
      - ';'
      - '&&'
      - '|'
      - '`'
      - '$('
      - '%3B'        # URL-encoded ;
      - '%26%26'     # URL-encoded &&
      - '%7C'        # URL-encoded pipe
  selection_cmd_tokens:
    cs-uri-query|contains:
      - 'whoami'
      - 'id'
      - '/etc/passwd'
      - 'cat /'
      - 'wget'
      - 'curl'
      - 'nc '
      - '/bin/sh'
      - 'bash -i'
      - 'nc.traditional'
      - 'python -c'
  filter_known_benign:
    cs-uri-query|contains:
      - '|'  # legitimately present in some query syntaxes
  condition: selection_uri and selection_cmd_tokens and not filter_known_benign
  timeframe: 10m
level: high
tags:
  - attack.t1210
  - attack.t1059
  - cve.2026-84387

YARA Rule

rule CVE_2026_84387_FortiSandbox_Command_Injection {
    meta:
        author = "Valters IT Security Research"
        description = "Detects payload patterns consistent with command injection against FortiSandbox management interfaces"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84387"
        date = "2026-01-01"
        cve = "CVE-2026-84387"
        score = 70
    strings:
        $shell_mc1 = ";"
        $shell_mc2 = "&&"
        $shell_mc3 = "|"
        $shell_mc4 = "`"
        $shell_mc5 = "$("
        $cmd1 = "whoami" nocase
        $cmd2 = "id" nocase
        $cmd3 = "/etc/passwd" nocase
        $cmd4 = "/bin/sh" nocase
        $cmd5 = "bash -i" nocase
        $cmd6 = "wget" nocase
        $cmd7 = "curl" nocase
        $cmd8 = "nc -e" nocase
        $cmd9 = "mkfifo" nocase
        $cmd10 = "python -c" nocase
        $http1 = "POST"
        $http2 = "fortisandbox" nocase
        $http3 = "login" nocase
    condition:
        uint16(0) == 0x0a0d or uint16(0) == 0x0d0a or $http1
        and (1 of ($shell_mc*) and 1 of ($cmd*)) and 4 of them
        or (1 of ($shell_mc*) and 2 of ($cmd*) and ($http2 or $http3))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-84387 FortiSandbox Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"FortiSandbox"; http_header; pcre:"/(?:%3B|%26%26|%7C|%60|\$\(|;|\|\||&&|`)/Ui"; pcre:"/(?:whoami|id\b|/etc/passwd|/bin/sh|bash\s+-i|wget|curl|nc\s+-e|mkfifo|python\s+-c)/Ui"; reference:cve,2026-84387; classtype:attempted-admin; sid:2026084387; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, signature_severity Major, attack_target server;)

Elastic Detection

// Elastic EQL — HTTP request-layer detection for FortiSandbox command injection
sequence by source.ip, destination.ip with maxspan=10m
  [network where network.protocol == "http" and destination.port in (443, 80, 8443)
   and destination.domain in ("*fortisandbox*", "*fortinet*")
   and url.query != null
   and (url.query contains ";" or url.query contains "&&" or url.query contains "`"
        or url.query contains "$(" or url.query contains "%3B" or url.query contains "%26%26"
        or url.query contains "%7C")]
  [process where event.action == "exec" and process.parent.name in ("php-fpm", "nginx", "httpd", "fortisandboxd"]

Splunk SPL Query

index=proxy OR index=web OR index=iis sourcetype=access_combined OR sourcetype=iis
| where like(uri_path, "%fortisandbox%") OR like(cs_Referer, "%fortisandbox%")
| regex _raw="(?i)((%3B|%26%26|%7C|%60|\$\(|;|\|\||&&|`).{0,100}(whoami|id|/etc/passwd|/bin/sh|bash|wget|curl|nc|mkfifo|python))"
| eval cve_id="CVE-2026-84387"
| table _time, src_ip, dest_ip, cs_method, uri_path, uri_query, cs_user_agent, sc_status, cve_id
| sort - _time

Wazuh OSSEC Rule

<group name="fortinet_fortisandbox,">
  <rule id="10084387" level="12">
    <decoded_as>json</decoded_as>
    <field name="url" type="pcre2">(?i)(%3B|%26%26|%7C|%60|\$\(|;|\|\||&&|`).{0,200}(whoami|/etc/passwd|/bin/sh|bash|wget|curl|nc\s|mkfifo|python)</field>
    <description>FortiSandbox command injection attempt (CVE-2026-84387)</description>
    <group>attack.t1210,attack.t1059,cve_2026_84387,</group>
    <mitre>
      <id>T1210</id>
    </mitre>
    <mitre>
      <id>T1059</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix exists from any tracked source. There is no Fortinet PSIRT advisory, no firmware release, and no workaround documentation specific to CVE-2026-84387 as of the analysis date. The guidance below is therefore defensive depth-in-depth until an official patch is released.

1) Immediate mitigations (days 0–7):

• Restrict network access to the FortiSandbox management interface. Limit administrative access (HTTPS/443, SSH, and the management VLAN) to only trusted jump hosts and IT-admin source addresses. Apply this at the firewall/VLAN level since the application itself has no authentication bypass — an attacker still needs valid admin credentials.
• Enforce multi-factor authentication (MFA) on all administrative accounts for FortiSandbox. Because the attack requires PR:H, strong credential hygiene materially raises the bar.
• Audit and rotate all existing FortiSandbox admin credentials, particularly any shared or service accounts. Check for accounts created or modified in the last 90 days.
• Disable or restrict the FortiSandbox API if it is not strictly required for operations.
• Review current configuration backup and ensure offline, immutable backups exist to support recovery in the event of compromise.

2) Patch/upgrade steps (when available):

• Subscribe to Fortinet PSIRT advisories (https://www.fortiguard.com/psirt) and monitor for an advisory referencing CVE-2026-84387.
• Because affected branches span 4.4.x, 5.0.x, and 5.2.x, plan an upgrade to the earliest fixed release once Fortinet publishes one. Historically, Fortinet resolves such issues in the newest branch (likely 5.2.x or a newer 5.3.x) and may backport to 5.0.x only on extended support contracts. Validate your support entitlement for the 4.4.x branch — that branch is approaching/at end-of-life for many products and may require a paid migration to a supported branch.
• Prior to patching, snapshot the appliance VM (if virtualized) or capture a full configuration backup. FortiSandbox upgrades are typically performed via the firmware upload page in the admin UI; follow Fortinet's official upgrade path documentation to avoid skipping required intermediate versions.

3) Long-term hardening:

• Treat FortiSandbox as a Tier-0/security-critical asset. Segment it from general user networks; allow only required east-west connectivity (submission sources, management, and reporting destinations).
• Implement centralized logging (Syslog to a SIEM) of all FortiSandbox admin actions and authentication events, feeding the detection rules above.
• Continuously review admin account usage and revoke privileges for users who do not require full appliance administration; use role-based admin accounts (read-only operators vs. super-admins) where the product supports it.
• Maintain a vulnerability management cadence: reconcile FortiSandbox firmware versions against new PSIRT advisories monthly.
• Monitor CISA KEV and Mandiant/Unit42 threat intel for any indication that CVE-2026-84387 is being actively exploited — as of this writing it is not listed and exploitation has not been confirmed in the wild.

Workarounds: None published by the vendor. The only compensating controls are network-level access restriction, MFA enforcement, and active monitoring.

References

1. NVD — CVE-2026-84387 Detail: https://nvd.nist.gov/vuln/detail/CVE-2026-84387 (National Vulnerability Database entry; canonical CVE metadata. Note: NVD description is currently (..) and should be revisited when completed.)
2. Fortinet PSIRT Advisories: https://www.fortiguard.com/psirt (Monitor for pending advisory on this CVE)
3. CWE-77 — Improper Neutralization of Special Elements used in a Command: https://cwe.mitre.org/data/definitions/77.html (Weakness class reference)
4. MITRE ATT&CK — T1059 Command and Scripting Interpreter: https://attack.mitre.org/techniques/T1059/ (Execution tactic relevant to post-injection command execution)
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (Checked — CVE-2026-84387 is NOT listed; revisit periodically)

Threat actor activity / exploit-in-the-wild: No evidence of exploitation in the wild, no public PoC, no exploit code, and no threat-actor campaign attribution has been identified for CVE-2026-84387 as of this writing. Given the PR:H requirement and the absence of a patch, this CVE currently poses a targeted-attack risk primarily to organizations whose FortiSandbox admin credentials are already compromised via other means, rather than a broad internet worm/campaign risk.