ZDI-26-645: Fortinet FortiSandbox write_remote_backup_to_crontab Command Injection (CVE‑2026‑84387) Enables Remote Code Execution
What It Is — Fortinet FortiSandbox contains a command‑injection flaw in the write_remote_backup_to_crontab API. An authenticated attacker can supply a crafted cronValue string that is passed unchecked to a system call, resulting in arbitrary code execution with root privileges.
Exploitability — The vulnerability is remotely exploitable once valid credentials are obtained; a proof‑of‑concept exists and the CVSS base score is 7.2 (High). No public exploit‑as‑a‑service is known, but the attack path is straightforward.
Affected Products — FortiSandbox (all versions prior to the September 2026 security update).
Why It Matters for Trust & Control Assurance
- Input‑validation & secure configuration – The flaw highlights a gap in controls that ensure only sanitized data reaches privileged system components, a core control objective across most frameworks.
- Audit‑ready evidence – Demonstrating that the “validate input before execution” control is enforced requires continuous monitoring logs and configuration baselines that can be presented during audits.
- Defensible risk posture – Enterprises that can prove they have automated checks for unsafe API parameters are better positioned to satisfy regulators and demanding customers.
Recommended Actions
- Apply Fortinet’s September 2026 patch (FG‑IR‑26‑167) immediately.
- Conduct a focused review of all custom API endpoints for proper input sanitization and least‑privilege execution.
- Enable detailed logging of API calls to the
write_remote_backup_to_crontabendpoint and integrate logs into a centralized SIEM for continuous monitoring. - Update your control‑mapping repository to reflect the remediation and capture evidence for audit purposes.