Fortinet FortiSandbox: critical GUI authentication bypass lets unauthenticated attackers run commands (CVE-2026-107656)
Fortinet FortiSandbox and FortiSandbox PaaS
Fortinet advisory FG-IR-26-185 describes an authentication bypass using an alternate path or channel (CWE-288) in the FortiSandbox GUI that lets a remote, unauthenticated attacker bypass authentication with crafted HTTP requests and execute unauthorized code or commands. It affects FortiSandbox 5.0.0 through 5.0.6 and 4.4.0 through 4.4.9, and FortiSandbox PaaS 5.0.0 through 5.0.6 and all 4.4 versions; the NVD record also lists FortiSandbox and PaaS 4.2 as affected. Fixes are FortiSandbox 5.0.7 and 4.4.10 (PaaS 5.0.7; PaaS 4.4 users must migrate to a fixed release). The 5.2 line is not affected. Fortinet rates it critical (CVSS 9.6 in the advisory, 9.8 on the CVE record) and says it is not known to be exploited. This is a separate bug from the FortiSandbox command injection CVE-2026-25089 that CISA flagged as exploited in July.
Why this severity: CVSS 9.6 per Fortinet's advisory (9.8 on the CVE record); unauthenticated and network-reachable; Fortinet says not known to be exploited and it is not in CISA KEV as of Oct 26
- Started
- Oct 13, 2026
Affected
- FortiSandbox 5.0.0 through 5.0.6
- FortiSandbox 4.4.0 through 4.4.9
- FortiSandbox 4.2 (all versions, per the NVD record)
- FortiSandbox PaaS 5.0.0 through 5.0.6
- FortiSandbox PaaS 4.4 (all versions)
Fixed in
- FortiSandbox 5.0.7 or above
- FortiSandbox 4.4.10 or above
- FortiSandbox PaaS 5.0.7 or above (PaaS 4.4: migrate to a fixed release)
- FortiSandbox 5.2 is not affected
Timeline2
CVE-2026-107656 is published to NVD with a CVSS 3.1 score of 9.8 from Fortinet, listing FortiSandbox and PaaS 4.2 as affected too.
Fortinet publishes FG-IR-26-185, a critical unauthenticated authentication bypass in the FortiSandbox GUI, found internally by Adham El Karn of Fortinet Product Security and also reported by Jason McFadyen of TrendAI Research.
Advisories2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
