Fortinet FortiSandbox: critical GUI authentication bypass lets unauthenticated attackers run commands (CVE-2026-107656) ยท updates https://pwn.watch/i/fortinet-fortisandbox-cve-2026-107656 Fortinet advisory FG-IR-26-185 describes an authentication bypass using an alternate path or channel (CWE-288) in the FortiSandbox GUI that lets a remote, unauthenticated attacker bypass authentication with crafted HTTP requests and execute unauthorized code or commands. It affects FortiSandbox 5.0.0 through 5.0.6 and 4.4.0 through 4.4.9, and FortiSandbox PaaS 5.0.0 through 5.0.6 and all 4.4 versions; the NVD record also lists FortiSandbox and PaaS 4.2 as affected. Fixes are FortiSandbox 5.0.7 and 4.4.10 (PaaS 5.0.7; PaaS 4.4 users must migrate to a fixed release). The 5.2 line is not affected. Fortinet rates it critical (CVSS 9.6 in the advisory, 9.8 on the CVE record) and says it is not known to be exploited. This is a separate bug from the FortiSandbox command injection CVE-2026-25089 that CISA flagged as exploited in July. en Mon, 26 Oct 2026 00:00:00 GMT Fortinet FortiSandbox: critical GUI authentication bypass lets unauthenticated attackers run commands (CVE-2026-107656): CVE-2026-107656 is published to NVD with a CVSS 3.1 score of 9.8 from Fortinet, listing FortiSandbox and PaaS 4.2 as affected too. https://pwn.watch/i/fortinet-fortisandbox-cve-2026-107656 https://pwn.watch/i/fortinet-fortisandbox-cve-2026-107656#2026-10-26-8a16d2a4 Mon, 26 Oct 2026 00:00:00 GMT critical <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-107656">Source</a></p> Fortinet FortiSandbox: critical GUI authentication bypass lets unauthenticated attackers run commands (CVE-2026-107656): Fortinet publishes FG-IR-26-185, a critical unauthenticated authentication bypass in the FortiSandbox GUI, found internally by Adham El Karn of Fortinet Product Security and also reported by Jason McFadyen of TrendAI Research. https://pwn.watch/i/fortinet-fortisandbox-cve-2026-107656 https://pwn.watch/i/fortinet-fortisandbox-cve-2026-107656#2026-10-13-f4d52434 Tue, 13 Oct 2026 00:00:00 GMT critical <p><a href="https://fortiguard.fortinet.com/psirt/FG-IR-26-185">Source</a></p>