Article
Fortinet Critical Vulnerability Fixes: What to Patch Before 10 November
Fortinet fixed critical flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. Details come 10 November. See the fixed builds.
Read more
Vulnerability
Fortinet FortiSandbox authentication bypass (CVE-2026-107656)
An authentication bypass (CWE-288) in the web interface of Fortinet FortiSandbox.
- CVE ID
- CVE-2026-107656
- CVSS
- 9.6 Critical (CVSSv3, Fortinet advisory); 9.8 Critical (CVSS 3.1, NVD)
- Affected product
- FortiSandbox and FortiSandbox PaaS (GUI)
- Exploited
- Unknown
- Published
- 13 October 2026 (advisory); 26 October 2026 (NVD)
In short
CVE-2026-107656 is an authentication bypass (CWE-288) in the web interface of Fortinet FortiSandbox. Fortinet says a remote attacker with no account may run unauthorized code or commands through crafted HTTP requests. The fixes are FortiSandbox 5.0.7 and 4.4.10.
- CVECVE-2026-107656
- ProductFortinet FortiSandbox and FortiSandbox PaaS (GUI)
- Fix Steps5actions listedCheck the version · Upgrade
What it allows
Fortinet's advisory FG-IR-26-185 is titled "Improper access control and session management in the web management interface". It describes an authentication bypass using an alternate path or channel (CWE-288) in the FortiSandbox GUI. A remote attacker with no account may bypass authentication through crafted HTTP requests. Fortinet rates it Critical with a CVSSv3 score of 9.6, and says the impact is running unauthorized code or commands.
Fortinet says its own Product Security team found the flaw, and thanks a TrendAI Research researcher for reporting it under responsible disclosure. The advisory says Known Exploited: No. It gives no technical detail about which request or path bypasses the login.
What Our Checks Showed
Exploit signals
- Public proof of concept (GitHub)YesOne repository for the CVE id, created 25 October at 18:34 UTC. It bundles three Fortinet flaws and claims a proof of concept and an exploit for each. Its own README says no exploitation is confirmed for this one. We read it as data, did not run it and do not link it25-26 Oct
- CISA KEVNot seenThe catalog release of 23 October 2026 does not list the flaw. Two other FortiSandbox flaws, CVE-2026-25089 and CVE-2026-39808, were added on 16 July 202623-26 Oct
Verdict Public repository claims exist, exploitation not confirmed by the vendor
The two catalog entries are separate flaws (OS command injection, CWE-78), not this one. They show that FortiSandbox has been a target before.
Fortinet's FortiSIEM flaw, covered on our CVE-2026-106173 page and in a FortiSIEM news post, comes from the same month of advisories. Fortinet also announced a separate hardening release for five other products, which does not include FortiSandbox.
Who is affected
Fortinet's advisory lists FortiSandbox 5.0.0 through 5.0.6 and 4.4.0 through 4.4.9. It names FortiSandbox 5.0.7 and 4.4.10 as the fixed builds. FortiSandbox 5.2 is listed as not affected.
FortiSandbox PaaS follows the same table. PaaS 5.0.0 through 5.0.6 should move to 5.0.7 or above. For PaaS 4.4, the advisory says all versions are affected and tells customers to migrate to a fixed release.
FortiSandbox 4.2
The advisory table we read has no 4.2 row. The CVE record, which Fortinet filed and NVD published, lists FortiSandbox 4.2 and FortiSandbox PaaS 4.2 as affected in all versions, with no fixed 4.2 build. Treat 4.2 as affected and plan a move to 4.4.10 or 5.0.7.
Score Differences
The advisory gives CVSSv3 9.6. NVD shows a CVSS 3.1 base score of 9.8 from Fortinet's vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The two numbers describe the same flaw with different inputs.
NVD Status
NVD published the record on 26 October 2026 at 14:16 UTC. When we read it the status was Received, and the only reference was the Fortinet advisory.
Timeline
- 13 Oct 2026
Fortinet publishes advisory FG-IR-26-185, rated Critical. It says the flaw was found internally and lists Known Exploited: No.
- 23 Oct 2026
The CISA Known Exploited Vulnerabilities catalog release of this date does not list the flaw.
- 25 Oct 2026
A public GitHub repository appears that claims a proof of concept for this flaw and two other Fortinet CVEs.
- 26 Oct 2026
NVD publishes the CVE record at 14:16 UTC with a CVSS 3.1 score of 9.8, from Fortinet's data.
What to do
-
Check the version
Open the FortiSandbox GUI and note the version. Fortinet lists 5.0.0 to 5.0.6 and 4.4.0 to 4.4.9 as affected, and NVD also lists 4.2.
-
Upgrade
Move 5.0 to 5.0.7 or above and 4.4 to 4.4.10 or above. Fortinet says FortiSandbox PaaS 4.4 customers must migrate to a fixed release.
-
Limit who can reach the GUI
The advisory lists no workaround. Until you patch, allow the management interface only from admin networks, and keep it off public addresses.
-
Review GUI access
Look in the web server and audit logs for requests to the GUI from addresses that never log in. Unexpected admin sessions or new accounts need a closer look.
-
Check your exposure
Look for FortiSandbox web interfaces on any public address in your external attack surface scan, and close them where they appear.
Questions
Which FortiSandbox versions does CVE-2026-107656 affect?
Fortinet lists FortiSandbox 5.0.0 through 5.0.6 and 4.4.0 through 4.4.9, plus FortiSandbox PaaS 5.0.0 through 5.0.6 and all PaaS 4.4. NVD also lists FortiSandbox 4.2 and PaaS 4.2, all versions. FortiSandbox 5.2 is not affected.
What fixes CVE-2026-107656?
Fortinet says to upgrade to FortiSandbox 5.0.7 or above, or 4.4.10 or above. PaaS 4.4 customers should migrate to a fixed release.
Is CVE-2026-107656 exploited?
Fortinet's advisory says Known Exploited: No. The flaw was not in the CISA KEV catalog release of 23 October 2026.
Does the attacker need an account?
No. Fortinet lists the attack type as unauthenticated: a remote attacker bypasses the login with crafted HTTP requests.
Why is the score 9.6 in one place and 9.8 in another?
The advisory gives CVSSv3 9.6 with temporal values. NVD shows a CVSS 3.1 base score of 9.8 from Fortinet's vector.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 53 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 60 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 151 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.