Is CVE-2026-106170 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106170 being exploited in the wild.

How severe is CVE-2026-106170?

Medium severity, with a CVSS score of 4.9, published 13 October 2026.

Which products and versions are affected?

Fortinet FortiSandbox 5.2.0 through 5.2.1, 5.0.0 through 5.0.6, 4.4 all versions.

Is there a fix for CVE-2026-106170?

Yes: fixed in FortiSandbox 5.2.2 or above; 5.0.7 or above; no fix available for 4.4 (migrate to fixed release). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106170 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-106170?

Check whether you run Fortinet FortiSandbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106170: Fortinet FortiSandbox persistent denial of service in GUI and CLI

CVE-2026-106170 · Severity: medium · CVSS 4.9 · Published 2026-10-13

Fortinet FortiSandbox is a malware analysis and sandboxing platform used to detect and analyze malicious code. A flaw in how the product handles certain HTTP requests allows a privileged administrator to crash the system's web interface and command-line access persistently, forcing a restart to restore functionality and disrupting security operations.

Technologies: Fortinet FortiSandbox. Vendors: Fortinet.

Quick answers

Is CVE-2026-106170 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106170 being exploited in the wild.
How severe is CVE-2026-106170?: Medium severity, with a CVSS score of 4.9, published 13 October 2026.
Which products and versions are affected?: Fortinet FortiSandbox 5.2.0 through 5.2.1, 5.0.0 through 5.0.6, 4.4 all versions.
Is there a fix for CVE-2026-106170?: Yes: fixed in FortiSandbox 5.2.2 or above; 5.0.7 or above; no fix available for 4.4 (migrate to fixed release). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106170 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-106170?: Check whether you run Fortinet FortiSandbox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FortiSandbox 5.2.2 or above; 5.0.7 or above; no fix available for 4.4 (migrate to fixed release)

Technical details

An uncaught exception vulnerability (CWE-248) in the FortiSandbox GUI component allows an authenticated attacker with administrative privileges to trigger a denial of service by sending specially crafted HTTP requests. The vulnerability affects the GUI component specifically and requires privileged access; it causes persistent unavailability of both GUI and CLI interfaces until system restart.

Affected products

Fortinet FortiSandbox 5.2.0 through 5.2.1, 5.0.0 through 5.0.6, 4.4 all versions

Timeline

2026-10-13: disclosed

References

https://fortiguard.fortinet.com/psirt/FG-IR-26-176

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.