FG-IR-26-176: Persistent Denial of Service in Admin Profile

Published Oct 13, 2026

Updated

An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests.

Affected Software

3 affected componentsFixes available

Fortinet FortiSandbox>=5.2.0<=5.2.1

Fortinet FortiSandbox>=5.0.0<=5.0.6

Fortinet FortiSandbox>=4.4

Event History

Oct 13, 2026

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker needs privileged access and must be able to send crafted HTTP requests to FortiSandbox. The provided data does not indicate that unauthenticated users can exploit it.

What is the operational impact if exploitation succeeds?

Successful exploitation can persistently deny access to both the FortiSandbox GUI and CLI. Confidentiality and integrity impact are listed as none, while availability impact is high.

How difficult is exploitation according to the available assessment?

The assessment lists network attack vector, low attack complexity, no user interaction, and high privileges required. Exploit maturity is rated functional.

FG-IR-26-176: Persistent Denial of Service in Admin Profile

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the operational impact if exploitation succeeds?

How difficult is exploitation according to the available assessment?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the operational impact if exploitation succeeds?

How difficult is exploitation according to the available assessment?