CVE-2026-106170: Fortinet FortiSandbox DOS Vulnerability

CVE-2026-106170 Overview

CVE-2026-106170 is an uncaught exception vulnerability [CWE-248] affecting multiple versions of Fortinet FortiSandbox. A privileged attacker can send crafted HTTP requests that trigger an unhandled exception, persistently denying access to both the graphical user interface (GUI) and command-line interface (CLI). The condition disrupts administrative control over the sandbox appliance and interferes with threat analysis workflows.

Fortinet published advisory FG-IR-26-176 describing the issue. The vulnerability requires high privileges and does not affect data confidentiality or integrity, but it produces a persistent availability impact on management interfaces.

Critical Impact
A privileged attacker can persistently deny GUI and CLI access to FortiSandbox appliances via crafted HTTP requests, disrupting malware analysis operations and administrative response capability.

Affected Products

Fortinet FortiSandbox 5.2.0 through 5.2.1
Fortinet FortiSandbox 5.0.0 through 5.0.6
Fortinet FortiSandbox 4.4 (all versions)

Discovery Timeline

2026-10-13 - CVE-2026-106170 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-106170

Vulnerability Analysis

The flaw is classified as CWE-248 (Uncaught Exception). FortiSandbox's HTTP management interface fails to handle a specific exception condition triggered by maliciously crafted requests. When the exception propagates without being caught, the service enters an unrecoverable state that blocks subsequent GUI and CLI access.

The denial of access is persistent, meaning the appliance does not self-recover without administrative intervention. During the outage window, operators cannot review sandbox detonation results, update policies, or export forensic artifacts.

Root Cause

The root cause is missing exception handling within the FortiSandbox management request processing path. The service does not sanitize or validate certain request structures before invoking logic that can raise an unhandled exception. Once raised, the exception terminates or deadlocks the management service responsible for both GUI and CLI access.

Attack Vector

Exploitation is network-based and requires authenticated access with high privileges on the target FortiSandbox. An attacker with existing administrative credentials or a compromised privileged session sends a crafted HTTP request to the management interface. The request triggers the uncaught exception, after which legitimate operators lose GUI and CLI access until recovery actions are performed on the appliance.

No public proof-of-concept, exploit code, or evidence of in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Fortinet Security Advisory FG-IR-26-176 for vendor-authoritative technical details.

Detection Methods for CVE-2026-106170

Indicators of Compromise

Sudden loss of GUI and CLI responsiveness on a FortiSandbox appliance without a preceding scheduled maintenance window.
Management service crash entries or unhandled exception traces in FortiSandbox system logs correlated with recent HTTP management traffic.
Unexpected administrative HTTP requests originating from unusual source addresses prior to loss of management access.

Detection Strategies

Forward FortiSandbox system and audit logs to a central SIEM or data lake and alert on management service restarts, exception stack traces, or GUI/CLI session termination events.
Baseline normal administrative request patterns against the FortiSandbox management interface and alert on anomalous request structures or request volumes from privileged accounts.
Correlate privileged account authentication events with subsequent service availability changes on FortiSandbox appliances.

Monitoring Recommendations

Monitor appliance reachability on both HTTPS management ports and SSH CLI ports with external synthetic checks.
Audit all accounts with administrative access to FortiSandbox and review their recent login sources and session activity.
Alert on configuration changes, failed logins, and session resets occurring in close proximity to one another.

How to Mitigate CVE-2026-106170

Immediate Actions Required

Apply the fixed FortiSandbox versions identified in Fortinet Security Advisory FG-IR-26-176 as soon as validated in your change window.
Restrict HTTP and HTTPS management access to a limited set of trusted administrative source IP addresses.
Rotate credentials for all privileged FortiSandbox administrative accounts and review recent privileged session history.

Patch Information

Fortinet documents fixed releases and upgrade paths in advisory FG-IR-26-176. Administrators should upgrade affected FortiSandbox 5.2.x, 5.0.x, and 4.4 deployments to the vendor-specified fixed versions. Confirm upgrade compatibility with existing integrations before deployment.

Workarounds

Place FortiSandbox management interfaces behind a dedicated management network or jump host accessible only to authorized operators.
Enforce multi-factor authentication on all privileged FortiSandbox accounts to reduce the risk of credential-based access by an attacker.
Limit the number of accounts holding administrative privileges and remove unused or stale administrative accounts.

bash

# Example: restrict FortiSandbox management access to trusted hosts
# (Adjust interface names and source subnets to match your environment)
config system interface
  edit port1
    set allowaccess https ssh ping
    set trusthost1 10.10.0.0 255.255.255.0
  next
end