Fortinet scores FortiSandbox GUI auth bypass CVE-2026-107656 at 9.6. Versions 5.0.0-5.0.6 and 4.4.0-4.4.9 are affected; fixes are 5.0.7 and 4.4.10.
Fortinet published advisory FG-IR-26-185 on 13 October 2026 for CVE-2026-107656, an authentication bypass in the FortiSandbox web GUI that affects FortiSandbox 5.0.0 through 5.0.6, 4.4.0 through 4.4.9 and FortiSandbox PaaS; it is fixed in 5.0.7 and 4.4.10. Fortinet says a remote, unauthenticated attacker "may" bypass authentication "via crafted HTTP requests" and "may be able to gain unauthorized access to the appliance" (from the advisory's CSAF file), and it lists the impact as "Execute unauthorized code or commands." Fortinet scores it 9.6 and rates it Critical. It marks the bug as not known to be exploited.
Who is affected
Fortinet's table lists these versions as affected, with fixes:
| Product | Affected | Fix |
|---|---|---|
| FortiSandbox 5.0 | 5.0.0 through 5.0.6 | 5.0.7 or above |
| FortiSandbox 4.4 | 4.4.0 through 4.4.9 | 4.4.10 or above |
| FortiSandbox PaaS 5.0 | 5.0.0 through 5.0.6 | 5.0.7 or above |
| FortiSandbox PaaS 4.4 | All versions | Migrate to a fixed release |
FortiSandbox 5.2 and FortiSandbox PaaS 5.2 are listed as not affected.
Affected FortiSandbox versions and fixed releases per Fortinet FG-IR-26-185.
The flaw
Fortinet classifies the bug as CWE-288, Authentication Bypass Using an Alternate Path or Channel, in the GUI component. The advisory title refers to "improper access control and session management in the web management interface." The CVSS v3 vector Fortinet publishes is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C: network-reachable, low complexity, no privileges and no user interaction. The score is Fortinet's own. NVD had no record for the CVE when we checked on 16 October.
Fortinet credits its Product Security team (Adham El Karn) with finding and reporting the issue internally. It also thanks Jason McFadyen of TrendAI Research for responsible disclosure.
The Zero Day Initiative published the same CVE on 15 October as ZDI-26-771, titled "login_user_profile Hard-Coded Credentials Authentication Bypass." ZDI scores it 7.3 (CVSS 3.0, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and says it was reported to the vendor on 19 June 2026. ZDI's description says the authentication mechanism uses hard-coded credentials. ZDI credits the same researcher Fortinet thanks, Jason McFadyen, and links to FG-IR-26-185, so this appears to be the same report described two ways. Fortinet's text omits the hard-coded credentials detail, and the scores differ because ZDI rates confidentiality, integrity and availability impact Low/Low/Low where Fortinet rates it High/High/High. The gap between ZDI's 19 June report and Fortinet's 13 October advisory is almost four months. Fortinet's public text does not name the vulnerable endpoint or the request structure.
Exploitation status
The Fortinet advisory lists "Known Exploited: No" and "Virtual Patch: No." CVE-2026-107656 is not in the CISA Known Exploited Vulnerabilities feed (release stamp 2026-10-15T17:00:11Z). We found no public exploit code. But Fortinet's own vector carries the temporal metric E:F, which CVSS 3.1 defines as "Functional exploit code is available. The code works in most situations" (FIRST specification). So Fortinet is saying a working exploit exists, even though it lists the bug as not known to be exploited. Whose exploit that is, Fortinet does not say; it may be the researcher's or Fortinet's own.
FortiSandbox has been a target this year. CISA's KEV feed lists two unauthenticated FortiSandbox bugs, both added on 16 July 2026 with a three-day due date: CVE-2026-25089, OS command injection via crafted HTTP requests (FG-IR-26-141, which also covers FortiSandbox Cloud and PaaS), and CVE-2026-39808 (FG-IR-26-100). Neither is this bug, but they show these appliances are exploited when bugs are public.
What defenders should do
- Inventory FortiSandbox appliances and PaaS instances, and compare the running version with the table above.
- Upgrade 5.0.x to 5.0.7 or later and 4.4.x to 4.4.10 or later. Fortinet lists no workaround, so upgrading is the only vendor-stated remediation.
- PaaS 4.4 has no fixed 4.4 build in the advisory. Fortinet says to migrate to a fixed release.
- Deployments on 5.2 need no action for this CVE.
- Until patched, treat the management GUI as sensitive. Fortinet does not prescribe this, but limiting GUI reachability to a management network reduces exposure to unauthenticated network attacks. Review access logs for unexpected GUI requests.
- If a 4.4 or 5.0 GUI was reachable from untrusted networks, also look for unexpected admin sessions and new accounts. That is our advice, not Fortinet's; the July KEV entries for FortiSandbox were flagged for forensic triage, which is the precedent.
- Watch the advisory and the KEV catalog for a change in exploitation status. Fortinet appliances move from patch to exploited fast: see the exploited FortiMail flaw and the earlier FortiVoice zero-day.