CVE-2026-106172: Escalation of privilege in Fortinet FortiSandbox

This vulnerability arises from the use of a hard-coded cryptographic key in Fortinet FortiSandbox versions 4.4 (all versions), 5.0.0 through 5.0.6, and 5.2.0 through 5.2.1, including corresponding FortiSandbox Cloud versions. Exploitation can lead to escalation of privilege through specially crafted HTTP requests. The CVSS 3.1 base score is 4.9 (medium severity), with network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality impact. An official fix has been released by Fortinet.

An attacker can escalate privileges on affected FortiSandbox systems by exploiting the hard-coded cryptographic key vulnerability. This could allow unauthorized access or actions at a higher privilege level. The confidentiality impact is limited, with no integrity or availability impacts reported.

An official fix is available from Fortinet for this vulnerability. Users should apply the vendor-provided patches to affected FortiSandbox versions promptly. Since this is not a cloud service, remediation depends on user action to update affected systems.