FG-IR-26-167: Cron Job Injection in Remote Backup

Published Sep 8, 2026

Updated

An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] in FortiSandbox may allow a privileged attacker to execute unauthorized code or commands via crafted HTTP requests.

Affected Software

4 affected componentsFixes available

Fortinet FortiSandbox=.

Fortinet FortiSandbox>=5.0.0<=5.0.6

Fortinet FortiSandbox>=4.4.0<=4.4.9

Fortinet FortiSandbox>=4.2

Event History

Sep 8, 2026

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The issue requires privileged access. Exploitation is performed through crafted HTTP requests by an authenticated attacker with sufficient privileges.

What is the potential impact if exploitation succeeds?

A successful exploit may allow execution of unauthorized code or commands. The reported impact includes high potential effects on confidentiality, integrity, and availability.

FG-IR-26-167: Cron Job Injection in Remote Backup

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?