ZDI-26-772: Fortinet FortiSandbox Admin Profile Improper Handling of Exceptional Conditions Denial-of-Service Vulnerability

Fortinet FortiSandbox has an uncaught-exception flaw (CWE-248) in how exceptional conditions are handled. A privileged attacker can send crafted HTTP requests that trigger the exception and persistently deny access to both the GUI and the CLI. The impact is availability only: confidentiality and integrity are unaffected, but administrators can be locked out of management until the condition is cleared. Affected releases are FortiSandbox 4.4 (all versions), 5.0.0 through 5.0.6, and 5.2.0 through 5.2.1. Fortinet assigned the issue (CVSS 3.1 base score 4.9); it is not in CISA KEV and no public proof-of-concept is known.

Do: Upgrade FortiSandbox to the fixed release Fortinet lists for your branch in the PSIRT advisory; fixed version numbers are not in this dataset, so confirm them with Fortinet before patching. Until then, restrict GUI and API management to trusted admin networks, because the flaw requires a privileged account. If the GUI or CLI becomes unavailable, treat it as a possible incident and recover the appliance using Fortinet's guidance.