CVE-2026-106170

Awaiting Analysis Awaiting Analysis - Queue

Uncaught Exception in Fortinet FortiSandbox Allows Denial of Service

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: Fortinet, Inc.

Description

An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106170

EUVD

EUVD-2026-98969

Affected Vendors & Products

Vendor	Product	Version / Range
Fortinet	FortiSandbox	5.2.0
Fortinet	FortiSandbox	5.0.0
Fortinet	FortiSandbox	4.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This vulnerability is an Uncaught Exception issue in Fortinet FortiSandbox versions 5.2.0 through 5.2.1, 5.0.0 through 5.0.6, and all versions of 4.4. A privileged attacker can exploit crafted HTTP requests to cause a persistent denial of access to both the GUI and CLI interfaces.

Detection Guidance

This vulnerability may cause persistent denial of access to GUI and CLI via crafted HTTP requests. Monitor for unusual HTTP traffic patterns or failed login attempts. Check FortiSandbox logs for repeated access denials or malformed requests. Ensure no unauthorized changes to system configurations.

Impact Analysis

The vulnerability allows an attacker to deny access to critical management interfaces (GUI and CLI) persistently. This could prevent administrators from configuring, monitoring, or managing the FortiSandbox device, disrupting security operations and potentially leaving systems unprotected.

Compliance Impact

This vulnerability allows a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests, which could disrupt security monitoring and incident response capabilities. This may impact compliance with standards like GDPR or HIPAA by impairing the ability to maintain data protection, audit logging, and timely breach detection.

Mitigation Strategies

Apply the latest security patches or updates provided by Fortinet for affected FortiSandbox versions to address the uncaught exception vulnerability.

Hi! I’m here to help you understand CVE-2026-106170. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70