FortiSandbox CVE-2026-106170

Exploitation requires the attacker to already hold HIGH privileges on the FortiSandbox appliance (PR:H) - a valid privileged/administrative account on the management interface - and to send a specially crafted HTTP request to that interface. No end-user interaction is needed (UI:N) and the request is reachable over the network (AV:N). The key limiting factors are the mandatory privileged authentication, which confines realistic abuse to insiders or post-compromise credential misuse, and the impact being limited to availability (persistent loss of GUI and CLI management access) with no data exposure or modification. Affected deployments are FortiSandbox 5.2.0-5.2.1, 5.0.0-5.0.6, and all 4.4 versions.

This is a genuine but modest-priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H, base 4.9 Medium) tells a consistent story: the attack is network-reachable and low-complexity, but requires HIGH privileges (PR:H) - meaning the attacker must already be an authenticated administrative/privileged user of the FortiSandbox. The only impact is availability (A:H); there is no confidentiality or integrity loss (C:N/I:N). No EPSS score, CISA KEV listing, or public POC was supplied in the input, so there is no signal of active or probable exploitation. Because exploitation is gated behind existing privileged access, the real-world risk is largely an insider or post-compromise (privilege-abuse) scenario rather than opportunistic mass exploitation - the high privilege requirement is the dominant mitigating factor. One cross-source conflict worth flagging: the input Tags list 'Information Disclosure', which contradicts the CVSS impact metrics (C:N, A:H) and the description (persistent denial of GUI/CLI access). This is a denial-of-service/availability bug, not information disclosure.

A privileged (authenticated) user of a FortiSandbox appliance - or an attacker who has already obtained privileged credentials - sends a crafted HTTP request to the management interface that triggers an uncaught exception (CWE-248). The resulting unhandled error persistently disables the administrative GUI and CLI, blocking legitimate operators from managing the device until manual recovery. No public exploit code was identified in the provided data.