Part of a story covered by 5 sources: “Fortinet and ZDI detail FortiSandbox and FortiOS flaws” — merged summary and timeline →
Persistent Denial of Service in Admin Profile
AI summary · grok-4.7-build
A privileged attacker can persistently deny FortiSandbox GUI and CLI access, CVSS 4.8.
Fortinet PSIRT advisory FG-IR-26-176 covers an uncaught exception (CWE-248) in FortiSandbox related to Admin Profile. A privileged attacker can use crafted HTTP requests to persistently deny access to both the GUI and CLI. The vulnerability is scored CVSS 4.8, was revised on 2026-10-13, and the notice does not report active exploitation.
- CVSS 4.8 uncaught exception (CWE-248) in FortiSandbox Admin Profile.
- A privileged attacker can persistently deny GUI and CLI access.
- Triggered by crafted HTTP requests; no in-the-wild exploitation stated.
- Advisory FG-IR-26-176 was revised on 2026-10-13.
Full article
CVSSv3 Score: 4.8 An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may allow a privileged attacker to deny access to the GUI and CLI persistently via crafted HTTP requests. Revised on 2026-10-13 00:00:00
This source does not provide full text. Read it at fortiguard.fortinet.com.