CVE-2026-106172
Received
Received - Intake
Hard-Coded Cryptographic Key in Fortinet FortiSandbox
Vulnerability report for CVE-2026-106172, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-13
Last updated on: 2026-10-13
Assigner: Fortinet, Inc.
Description
Description
A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker to escalation of privilege via specially crafted HTTP requests
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Fortinet | FortiSandbox | 5.2.0 |
| Fortinet | FortiSandbox | 5.0.0 |
| Fortinet | FortiSandbox | 4.4.0 |
| Fortinet | FortiSandbox | Cloud 5.0.4 |
| Fortinet | FortiSandbox | Cloud 5.0.0 |
| Fortinet | FortiSandbox | Cloud 4.4.0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-321 | The product uses a hard-coded, unchangeable cryptographic key. |
