CVE-2026-106170: Persistent Denial of Service in Admin Profile
An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests.
Other sources
An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FortiSandboxto a version that resolves this vulnerability.Fixed in 5.0.7 - Upgrade
Upgrade
FortiSandboxto a version that resolves this vulnerability.Fixed in 5.2.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already have privileged access to the affected FortiSandbox system. The attack can be performed remotely using crafted HTTP requests and does not require user interaction.
What is the operational impact if exploitation succeeds?
Successful exploitation can persistently deny access to both the FortiSandbox GUI and CLI. This can prevent administrators from managing the appliance through its normal interfaces.
Which FortiSandbox releases are affected?
Affected releases are FortiSandbox 5.2.0 through 5.2.1, 5.0.0 through 5.0.6, and all FortiSandbox 4.4 versions.