4.8
MediumCVSS 3.1 · from fortinet
CVE-2026-106170
An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow a privileged…
FortiSandbox · CWE-248 · CWE-248AffectedFortiSandbox
FixNo fix listed yet.
PublishedOct 13, 17:37 · fortinet
ScoredOct 13 · 4.8 · fortinet
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
A successful attack can take the service down. CVSS impact.
Description
An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests.
From fortinet
Affected and fixed versions
ProductAffectedFixed inFortiSandbox5.2.0 – 5.2.1–FortiSandbox5.0.0 – 5.0.6–FortiSandbox4.4.0 – 4.4.10–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known