Is CVE-2026-84387 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84387 being exploited in the wild.

How severe is CVE-2026-84387?

High severity, with a CVSS score of 7.2, published 8 September 2026.

Which products and versions are affected?

Fortinet FortiSandbox 4.4.0 through 4.4.9, 5.0.0 through 5.0.6, 5.2.0.

Is there a fix for CVE-2026-84387?

A patch was published on 2026-09-08: FortiSandbox 4.4.10+, 5.0.7+, 5.2.1+ available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84387 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-84387?

Check whether you run Fortinet FortiSandbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84387: Fortinet FortiSandbox command injection in HTTP requests

CVE-2026-84387 · Severity: high · CVSS 7.2 · Published 2026-09-08

FortiSandbox is a malware analysis and sandboxing appliance used by enterprises to safely detonate and analyze suspicious files. A command injection vulnerability in its web interface allows a privileged attacker to execute arbitrary commands on the system through crafted HTTP requests, potentially compromising the integrity of threat analysis operations and lateral movement into the network.

Technologies: Fortinet FortiSandbox. Vendors: Fortinet.

Quick answers

Is CVE-2026-84387 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84387 being exploited in the wild.
How severe is CVE-2026-84387?: High severity, with a CVSS score of 7.2, published 8 September 2026.
Which products and versions are affected?: Fortinet FortiSandbox 4.4.0 through 4.4.9, 5.0.0 through 5.0.6, 5.2.0.
Is there a fix for CVE-2026-84387?: A patch was published on 2026-09-08: FortiSandbox 4.4.10+, 5.0.7+, 5.2.1+ available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84387 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-84387?: Check whether you run Fortinet FortiSandbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper neutralization of special elements in command strings (CWE-77 / command injection) exists in the FortiSandbox GUI component. The vulnerability is triggered via crafted HTTP requests and requires authenticated access (privileged user credentials). A successful exploit allows an attacker to execute unauthorized system commands with FortiSandbox process privileges. The vulnerability affects FortiSandbox 4.4.0–4.4.9, 5.0.0–5.0.6, and 5.2.0; patches are available (4.4.10+, 5.0.7+, 5.2.1+).

Affected products

Fortinet FortiSandbox 4.4.0 through 4.4.9, 5.0.0 through 5.0.6, 5.2.0

Timeline

2026-09-08: disclosed
2026-09-08: patched: FortiSandbox 4.4.10+, 5.0.7+, 5.2.1+ available

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-167

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.