FortiSandbox Vulnerability Allows Persistent Denial of Service

Fortinet has issued a security advisory detailing a Persistent Denial of Service (PDoS) vulnerability, identified as FG-IR-26-176, affecting its FortiSandbox product line. The vulnerability, which stems from an uncaught exception within the admin profile configuration, can be exploited by a privileged attacker to render both the graphical user interface (GUI) and the command-line interface (CLI) inaccessible.

The attack vector involves sending specially crafted HTTP requests to the affected FortiSandbox instances. While the vulnerability requires an attacker to already possess administrative privileges, its successful exploitation leads to a persistent denial of service, meaning the system remains inaccessible until manually remediated. The vulnerability has been assigned a CVSSv3 score of 4.8, categorizing it as medium severity.

Fortinet has identified specific versions of FortiSandbox that are vulnerable, including FortiSandbox versions 5.2, 5.0, and 4.4. The company has provided a CVE identifier, CVE-2026-106170, for this specific flaw. The advisory notes that the vulnerability is related to CWE-248, which pertains to uncaught exceptions, a common source of unexpected behavior and potential security exploits in software.

The vulnerability was responsibly disclosed to Fortinet by Jason McFadyen of TrendAI Research. This disclosure highlights the ongoing efforts of security researchers in identifying and reporting potential weaknesses in widely used security appliances. Fortinet's prompt response and advisory publication are crucial steps in informing customers and enabling them to take necessary protective measures.

While the advisory does not explicitly state whether this vulnerability is being actively exploited in the wild, the nature of denial-of-service attacks means that even a theoretical possibility warrants attention. Organizations relying on FortiSandbox for their security infrastructure should review their deployed versions and consult Fortinet's guidance for mitigation and remediation.

Fortinet's advisory provides a link to the full details of the vulnerability, including the CVSS scoring breakdown and affected product versions. The company's PSIRT (Product Security Incident Response Team) is the primary channel for such disclosures, ensuring a structured approach to vulnerability management and customer communication. Users are encouraged to visit the Fortinet PSIRT website for the latest information and advisories.

This incident underscores the importance of maintaining up-to-date security software and diligently applying patches and configuration updates. Even privileged users can inadvertently introduce risks, and robust security practices are essential for protecting critical infrastructure from potential disruption.