# Fortinet FortiSandbox: critical GUI authentication bypass lets unauthenticated attackers run commands (CVE-2026-107656) · pwn.watch

> Fortinet advisory FG-IR-26-185 describes an authentication bypass using an alternate path or channel (CWE-288) in the FortiSandbox GUI that lets a remote, unauthenticated attacker bypass authentication with crafted HTTP requests and execute unauthorized code or commands. It affects FortiSandbox 5.0.0 through 5.0.6 and 4.4.0 through 4.4.9, and FortiSandbox PaaS 5.0.0 through 5.0.6 and all 4.4 versions; the NVD record also lists FortiSandbox and PaaS 4.2 as affected. Fixes are FortiSandbox 5.0.7 and 4.4.10 (PaaS 5.0.7; PaaS 4.4 users must migrate to a fixed release). The 5.2 line is not affected. Fortinet rates it critical (CVSS 9.6 in the advisory, 9.8 on the CVE record) and says it is not known to be exploited. This is a separate bug from the FortiSandbox command injection CVE-2026-25089 that CISA flagged as exploited in July.

Page: https://pwn.watch/i/fortinet-fortisandbox-cve-2026-107656 · generated 2026-10-26T16:41:01.393Z

## Status
- Severity: critical · status: live · patch: patched
- Product: Fortinet FortiSandbox and FortiSandbox PaaS
- Started: 2026-10-13
- CVEs: CVE-2026-107656
- Affected: FortiSandbox 5.0.0 through 5.0.6; FortiSandbox 4.4.0 through 4.4.9; FortiSandbox 4.2 (all versions, per the NVD record); FortiSandbox PaaS 5.0.0 through 5.0.6; FortiSandbox PaaS 4.4 (all versions)
- Fixed in: FortiSandbox 5.0.7 or above; FortiSandbox 4.4.10 or above; FortiSandbox PaaS 5.0.7 or above (PaaS 4.4: migrate to a fixed release); FortiSandbox 5.2 is not affected

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/fortinet-fortisandbox-cve-2026-107656/feed.xml
- JSON Feed: https://pwn.watch/i/fortinet-fortisandbox-cve-2026-107656/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/fortinet-fortisandbox-cve-2026-107656.json
- This file: https://pwn.watch/i/fortinet-fortisandbox-cve-2026-107656/llms.txt

## Updates (newest first)
- 2026-10-26: CVE-2026-107656 is published to NVD with a CVSS 3.1 score of 9.8 from Fortinet, listing FortiSandbox and PaaS 4.2 as affected too. (https://nvd.nist.gov/vuln/detail/CVE-2026-107656)
- 2026-10-13: Fortinet publishes FG-IR-26-185, a critical unauthenticated authentication bypass in the FortiSandbox GUI, found internally by Adham El Karn of Fortinet Product Security and also reported by Jason McFadyen of TrendAI Research. (https://fortiguard.fortinet.com/psirt/FG-IR-26-185)

## Fix brief
# Security brief: Fortinet FortiSandbox: critical GUI authentication bypass lets unauthenticated attackers run commands (CVE-2026-107656)

Source: https://pwn.watch/i/fortinet-fortisandbox-cve-2026-107656 · status: live · severity: critical · updated Oct 26, 2026, 15:23 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Fortinet advisory FG-IR-26-185 describes an authentication bypass using an alternate path or channel (CWE-288) in the FortiSandbox GUI that lets a remote, unauthenticated attacker bypass authentication with crafted HTTP requests and execute unauthorized code or commands. It affects FortiSandbox 5.0.0 through 5.0.6 and 4.4.0 through 4.4.9, and FortiSandbox PaaS 5.0.0 through 5.0.6 and all 4.4 versions; the NVD record also lists FortiSandbox and PaaS 4.2 as affected. Fixes are FortiSandbox 5.0.7 and 4.4.10 (PaaS 5.0.7; PaaS 4.4 users must migrate to a fixed release). The 5.2 line is not affected. Fortinet rates it critical (CVSS 9.6 in the advisory, 9.8 on the CVE record) and says it is not known to be exploited. This is a separate bug from the FortiSandbox command injection CVE-2026-25089 that CISA flagged as exploited in July.

Severity detail: CVSS 9.6 per Fortinet's advisory (9.8 on the CVE record); unauthenticated and network-reachable; Fortinet says not known to be exploited and it is not in CISA KEV as of Oct 26

- Product: Fortinet FortiSandbox and FortiSandbox PaaS
- CVE / advisory ids: CVE-2026-107656

## Affected versions
- FortiSandbox 5.0.0 through 5.0.6
- FortiSandbox 4.4.0 through 4.4.9
- FortiSandbox 4.2 (all versions, per the NVD record)
- FortiSandbox PaaS 5.0.0 through 5.0.6
- FortiSandbox PaaS 4.4 (all versions)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- FortiSandbox 5.0.7 or above
- FortiSandbox 4.4.10 or above
- FortiSandbox PaaS 5.0.7 or above (PaaS 4.4: migrate to a fixed release)
- FortiSandbox 5.2 is not affected

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Oct 26, 2026: CVE-2026-107656 is published to NVD with a CVSS 3.1 score of 9.8 from Fortinet, listing FortiSandbox and PaaS 4.2 as affected too.
- Oct 13, 2026: Fortinet publishes FG-IR-26-185, a critical unauthenticated authentication bypass in the FortiSandbox GUI, found internally by Adham El Karn of Fortinet Product Security and also reported by Jason McFadyen of TrendAI Research.

## Advisories
- [FG-IR-26-185: Authentication bypass in FortiSandbox GUI](https://fortiguard.fortinet.com/psirt/FG-IR-26-185) (Fortinet PSIRT)
- [NVD: CVE-2026-107656](https://nvd.nist.gov/vuln/detail/CVE-2026-107656) (NIST NVD)

---
Machine-readable: https://pwn.watch/i/fortinet-fortisandbox-cve-2026-107656.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.