An uncaught exception flaw (CWE‑248) exists in Fortinet FortiSandbox. The flaw allows a privileged attacker to deny access to both the graphical user interface (GUI) and command‑line interface (CLI) persistently through specially crafted HTTP requests. Because the attack relies on an uncaught exception, the failure is not recoverable, resulting in complete denial of service to authorized users.

The vulnerability affects Fortinet FortiSandbox versions 5.2.0–5.2.1, 5.0.0–5.0.6, and all 4.4.x releases. Administrators should verify if their deployment matches any of these version ranges and consider the impact accordingly.

The CVSS score of 4.8 indicates a moderate impact, and the EPSS score is currently unavailable, so the likelihood of exploitation is unknown. The flaw is not listed in the CISA KEV catalog. Attackers require privileged access to send crafted HTTP requests; the likely attack vector is remote access that exploits the FortiSandbox web interface, but the documentation does not detail whether local or network isolation mitigates the risk.