Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
6108 articles · 249325 vulns · 37/41 feeds (7d)
← Back to list
4.9
CVE-2026-106172
Fortinet · FortiSandbox

CVE-2026-106172: A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 thr

Description

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4 all versions, FortiSandbox Cloud 5.2.0 through 5.2.1, FortiSandbox Cloud 5.0.0 through 5.0.6, FortiSandbox Cloud 4.4 all versions may allow attacker to escalation of privilege via specially crafted HTTP requests

Affected Products

VendorProductVersions
FortinetFortiSandbox5.2.0, 5.0.0, 4.4.0, 5.0.4, 5.0.0, 4.4.0

Also Affects

Downstream vendors/products affected by this vulnerability

VendorProductSourceConfidence
fortinetfortisandbox cloudmitre_affected90%
fortinetfortisandboxcert_advisory90%

References

  • https://fortiguard.fortinet.com/psirt/FG-IR-26-179

Related News (4 articles)

Tier B
BSI Advisories9d ago
[NEU] [hoch] Fortinet FortiSandbox: Mehrere Schwachstellen
→ No new info (linked only)
Tier B
CERT-FR9d ago
Multiples vulnérabilités dans les produits Fortinet (14 octobre 2026)
→ No new info (linked only)
Tier C
VulDB9d ago
CVE-2026-106172 | Fortinet FortiSandbox/FortiSandbox Cloud up to 5.2.1/5.0.6/4.4 privileges management
→ No new info (linked only)
Tier A
Fortinet PSIRT10d ago
Fabric API Authentication bypass
→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.14.9 MEDIUM
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C
CISA KEV❌ No
Actively exploited❌ No
CWECWE-321
PublishedOct 13, 2026
Last enriched9d ago
Tags
os command injectionauthentication bypassprivilege escalationheap-based buffer overflowsql injectionfortinetcritical vulnerability
Trending Score20
Source articles4
Independent4
Info Completeness8/14
Missing: epss, kev, exploit, patch, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

CRITICALCVE-2026-106173
CVE-2026-106173: A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5
Trending: 57
HIGHPRE-CVE
Multiple vulnerabilities in Fortinet FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator allow unspecified attack
Trending: 27
HIGHCVE-2025-46773
CVE-2025-46773: An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerabi
Trending: 18
MEDIUMCVE-2026-23706
CVE-2026-23706: An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerabi
Trending: 16
MEDIUMCVE-2026-23705
CVE-2026-23705: An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerabi
Trending: 16

Pin to Dashboard

Verification

State: verified
Confidence: 0%

Vulnerability Timeline

CVE Published
Oct 13, 2026
Discovered by ZDM
Oct 13, 2026