FortiSandbox CVE-2026-106172

The attacker must be able to reach the FortiSandbox (or FortiSandbox Cloud) HTTP/management interface over the network and possess the hard-coded cryptographic key embedded in the firmware, which is used to construct trusted 'specially crafted HTTP requests.' Per CVSS PR:N/UI:N, no valid credentials or user interaction are required once the static key is known. Affected deployments are limited to specific versions: FortiSandbox 5.2.0-5.2.1, 5.0.0-5.0.6, and all 4.4; and FortiSandbox Cloud 5.2.0-5.2.1, 5.0.0-5.0.6, and all 4.4. The primary limiting factor is network exposure of the management interface - appliances whose HTTP interface is not reachable by the attacker are not exploitable from that path.

This is a moderate-severity issue (official CVSS 5.3) that should be patched but does not represent an emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction - favorable conditions for an attacker. However, the declared impact is limited to low confidentiality only (C:L/I:N/A:N), which is in tension with the description's claim of 'escalation of privilege': a genuine privilege escalation would normally carry an integrity or scope impact, so the low-only rating suggests the escalation is narrow or partial - verify the exact privilege gained with Fortinet. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is therefore driven by the vulnerability's inherent reachability rather than any observed in-the-wild activity. The hard-coded cryptographic key (CWE-321) is the core weakness: once the static key is extracted from firmware, exploitation becomes trivial and automatable, which could rapidly change the risk picture if a POC emerges. Net assessment: a credible, patch-worthy flaw in a security appliance, but currently a standard-priority item absent exploitation signals, not a drop-everything critical.

An attacker with network access to the FortiSandbox management/HTTP interface leverages the hard-coded cryptographic key - recoverable from the firmware or shared across all deployments - to forge or sign specially crafted HTTP requests that the appliance trusts. This lets the attacker gain unauthorized access to privileged functionality or data without valid credentials. No public exploit code was identified in the provided data, but the static-key nature means a reliable exploit would be straightforward to develop once the key is known.