The vulnerability arises from insufficient protection of credentials used by Fortinet FortiSandbox. An authenticated administrator can exploit client‑side inspection to view the LDAP server credentials that the sandbox accesses. This disclosure can expose privileged secrets, enabling further internal attacks or privilege escalation. The weakness corresponds to CWE‑522, Credential Exposure.

The vulnerability affects Fortinet FortiSandbox versions 4.4.x, 5.0.0 through 5.0.5, and FortiSandbox PaaS versions 5.0.1 through 5.0.5. These are all releases listed by Fortinet, ranging from on‑premises appliances to cloud‑based PaaS deployments.

The CVSS score is 2.5, classification as low severity, and the vulnerability is not currently listed in CISA’s KEV catalog. Exploit probability data is not available. Exploitation requires an authenticated administrator and relies on client‑side inspection of LDAP credentials, implying that only users with privileged access could exploit this. Consequently, the risk of widespread exploitation is limited, but internal attackers possessing administrative rights remain at risk.