Vulnerability in Fortinet FortiSandbox

[ Description ]Official description

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker to escalation of privilege via specially crafted HTTP requests

[ Fixes ]Fixes and patches

• Security bulletin: Fortinet FG-IR-26-176Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-176, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-177Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-177, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-182Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-182, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-179Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-179, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-178Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-178, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-185Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-185, cited by CERT-FR CERTFR-2026-AVI-1306
• Security bulletin: Fortinet FG-IR-26-181Vendor patch or bulletin · CERT-FR · fortiguard.com/psirt/FG-IR-26-181, cited by CERT-FR CERTFR-2026-AVI-1306

[ Advisories ]Government CERT advisories

• NCSC-NL14 Oct 2026NCSC-2026-0428

  Vulnerabilities fixed in Fortinet FortiSandbox Translated from Dutch

  Probability/damage M/HCVE-2026-107656CVE-2026-106170CVE-2026-106172
• CERT-FR14 Oct 2026CERTFR-2026-AVI-1306

  Multiple vulnerabilities in Fortinet products Translated from French

  Multiple vulnerabilities have been discovered in Fortinet products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-106171CVE-2026-23705CVE-2026-23706+7 more CVEs
• BSI CERT-Bund13 Oct 2026WID-SEC-2026-3940

  Fortinet FortiSandbox: Multiple vulnerabilities Translated from German

  CVE-2026-106172CVE-2026-106170CVE-2026-107656

[ References ]References

• fortiguard.fortinet.com/psirt/FG-IR-26-179