Fortinet FortiSandbox CVE-2026-107656 (CVSS 9.6): unauthenticated GUI authentication bypass via crafted HTTP requests; upgrade to 5.0.7 or 4.4.10, FortiSandbox PaaS 4.4 must migrate

Fortinet published FG-IR-26-185 on 13 October 2026 for CVE-2026-107656, a critical authentication bypass using an alternate path or channel (CWE-288) in the FortiSandbox web management GUI. A remote, unauthenticated attacker can send crafted HTTP requests to get past authentication, and Fortinet lists the impact as executing unauthorised code or commands. It rates the flaw 9.6 (CVSS 3.1). FortiSandbox 5.0.0 to 5.0.6 and 4.4.0 to 4.4.9 are affected, as are FortiSandbox PaaS 5.0.0 to 5.0.6 and every PaaS 4.4 release; the 5.2 branch is not affected. Fortinet's product security team found it internally, and Jason McFadyen of TrendAI Research also reported it. The advisory marks it as not known to be exploited. It was part of Fortinet's 13 October monthly PSIRT release, which also fixed a separate critical FortiSIEM flaw (CVE-2026-106173, its own card) and lower-rated FortiSandbox, FortiOS, FortiManager, FortiAnalyzer and FortiMail issues. FortiSandbox sits in the mail and web inspection path and holds samples of suspicious files, so an exposed admin interface is a high-value target. Wire: Cyber Security News (13 Oct).

Product

Fortinet FortiSandbox and FortiSandbox PaaS (web management GUI)

Versions

Affected: FortiSandbox 5.0.0–5.0.6, 4.4.0–4.4.9; FortiSandbox PaaS 5.0.0–5.0.6 and all PaaS 4.4. Not affected: FortiSandbox and PaaS 5.2. Fixed: 5.0.7 and 4.4.10 or later.

CVSS

9.6 (Fortinet, CVSS 3.1)

Exploited in Australia?

unknown

Patch to

Upgrade FortiSandbox to 5.0.7 or 4.4.10 (or later), or move to 5.2. FortiSandbox PaaS 4.4 tenants must migrate to a fixed release. Until patched, make sure the FortiSandbox management GUI is reachable only from an admin network or jump host, never from the internet, and review admin logins and configuration changes since early October.

Primary: Fortinet PSIRT FG-IR-26-185 — FortiSandbox improper access control and session management in the web management interface (13 Oct 2026) · Vendor: FortiGuard — CVE-2026-107656 FortiSandbox GUI authentication bypass · CVE: CVE-2026-107656, CVE-2026-106173 · Cyber Security News — Critical FortiSandbox GUI vulnerability allows remote attackers to bypass authentication (13 Oct 2026)

vulnerabilities network