CVE-2026-106172
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox (including Cloud versions) may allow an attacker to escalate privileges via specially crafted HTTP requests.
Risk Assessment
An attacker may exploit the hard-coded key to escalate privileges and gain unauthorized access. Multiple FortiSandbox and FortiSandbox Cloud versions are affected.
Recommendation
Update FortiSandbox to versions containing the fix. Restrict access to management interfaces to trusted networks.
Other vulnerabilities in FortiSandbox
See all- CVE-2026-25089CriticalActively exploited
An OS command injection vulnerability in Fortinet FortiSandbox (versions 5.0.0-5.0.5, 4.4.0-4.4.8, 4.2 all, FortiSandbox Cloud 5.0.4-5.0.5, FortiSandbox PaaS 5.0.4-5.0.5). An unauthenticated attacker can execute unauthorized commands via crafted HTTP requests.
- CVE-2026-26083Critical
A missing authorization vulnerability in Fortinet FortiSandbox allows an unauthenticated attacker to execute unauthorized code or commands via HTTP requests. The issue affects multiple versions of FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS.
- CVE-2026-39808CriticalActively exploited
An OS command injection vulnerability has been discovered in Fortinet FortiSandbox versions 4.4.0 through 4.4.8. This flaw is due to improper neutralization of special elements used in OS commands.
- CVE-2025-53949High
An OS Command Injection vulnerability in Fortinet FortiSandbox versions 5.0.0 through 5.0.2, 4.4.0 through 4.4.7, 4.2 all versions, and 4.0 all versions may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests.
- CVE-2026-106170Medium
An Uncaught Exception vulnerability [CWE-248] in Fortinet FortiSandbox may allow a privileged attacker to persistently deny access to the GUI and CLI via crafted HTTP requests.
- CVE-2026-84387High
A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via <insert attack vector here>
- CVE-2026-59835High
A vulnerability in Fortinet FortiSandbox versions 5.0.0-5.0.2 and 4.4.3-4.4.8 allows an unauthenticated attacker to access the VNC server of scanning VMs. The issue is due to improper resource access restrictions.
- CVE-2025-61886Medium
Cross-Site Scripting (XSS) vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4 and FortiSandbox PaaS 5.0.0 through 5.0.4. An attacker can perform an XSS attack via crafted HTTP requests.
- CVE-2025-46215Medium
An improper isolation or compartmentalization vulnerability (CWE-653) in Fortinet FortiSandbox (5.0.0–5.0.1, 4.4.0–4.4.7, 4.2 all versions, 4.0 all versions) may allow an unauthenticated attacker to evade sandbox scanning via a crafted file.
Original NVD description (English source)
A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker to escalation of privilege via specially crafted HTTP requests
Vulnerability data from NVD (NIST) · CISA KEV · EPSS