Latest vulnerabilities for "fortinet fortisandbox" 5.0.6

Where

AND

Sort:

Fortinet FortiSandboxFabric API Authentication bypass

Risk 27

Severity

5.3

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted HTTP requests

1 / 3

Source: FortiGuard

First published (updated )

CVE-2026-106172

Fortinet FortiSandboxPersistent Denial of Service in Admin Profile

Risk 30

Severity

4.9

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C

An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests.

1 / 2

Source: FortiGuard

Remedy

Upgrade to FortiSandbox version 5.2.2 or above Upgrade to FortiSandbox version 5.0.7 or above

First published (updated )

CVE-2026-106170

Fortinet FortiSandboxImproper access control and session management in the web management interface

Risk 86

Severity

9.8

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests.

1 / 2

Source: FortiGuard

First published (updated )

CVE-2026-107656

Fortinet FortiSandboxFabric API Authentication bypass

Risk 26

Severity

4.9

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C

A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted HTTP requests

First published (updated )

Advisory

FG-IR-26-179

Fortinet FortiSandboxPersistent Denial of Service in Admin Profile

Risk 29

Severity

4.8

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C

An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests.

First published (updated )

Advisory

FG-IR-26-176

Fortinet FortiSandboxImproper access control and session management in the web management interface

Risk 85

Severity

9.6

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests.

First published (updated )

Advisory

FG-IR-26-185

Fortinet FortiSandboxCron Job Injection in Remote Backup

Risk 66

Severity

7.2

Command Injection

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] in FortiSandbox may allow a privileged attacker to execute unauthorized code or commands via crafted HTTP requests.

1 / 2

Source: FortiGuard

First published (updated )

CVE-2026-84387

Fortinet FortiSandboxCron Job Injection in Remote Backup

Risk 65

Severity

6.7

Command Injection

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

First published (updated )

Advisory

FG-IR-26-167

Trending

Fortinet FortiSandboxFabric API Authentication bypass

Fortinet FortiSandboxPersistent Denial of Service in Admin Profile

Remedy

Fortinet FortiSandboxImproper access control and session management in the web management interface

Fortinet FortiSandboxFabric API Authentication bypass

Fortinet FortiSandboxPersistent Denial of Service in Admin Profile

Fortinet FortiSandboxImproper access control and session management in the web management interface

Fortinet FortiSandboxCron Job Injection in Remote Backup

Fortinet FortiSandboxCron Job Injection in Remote Backup

Company

Resources

Contact