ZDI 2026-10-15

ZDI-26-772: Fortinet FortiSandbox Admin Profile Improper Handling of Exceptional Conditions Denial-of-Service Vulnerability

CVE-2026-106170

Machine-generated analysis · WAYSCloud LLM

Authenticated remote attackers can cause a denial-of-service on FortiSandbox.

Context

The advisory concerns Fortinet FortiSandbox. It describes an improper handling of exceptional conditions in the admin profile that allows authenticated remote attackers to trigger a denial-of-service. The vulnerability is tracked as CVE-2026-106170 with a CVSS score of 4.9.

Operator considerations

Check: verify that only authorized administrators have valid credentials for the FortiSandbox admin profile.
Log: monitor authentication logs for unusual or repeated admin logins that could precede a DoS attempt.
Isolate: consider restricting admin interface access to trusted network segments.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Fortinet FortiSandbox. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 4.9. The following CVEs are assigned: CVE-2026-106170.

Read the full advisory on ZDI →