Critical FortiSandbox GUI Vulnerability Allows Remote Attackers to Bypass Authentication

Fortinet disclosed a critical authentication-bypass vulnerability in the FortiSandbox graphical user interface that could let remote attackers access protected functions without valid credentials. Tracked as CVE-2026-107656, the flaw carries a reported CVSSv3 score of 9.6 and affects both FortiSandbox appliances and selected FortiSandbox PaaS releases.

Published on October 13, 2026, the disclosure is tracked under Fortinet advisory FG-IR-26-185. Fortinet lists the potential impact as execution of unauthorized code or commands. Its advisory marks known exploitation as “No,” meaning the disclosure does not establish that attackers have already used this vulnerability in real attacks.

The weakness is classified as CWE-288, Authentication Bypass Using an Alternate Path or Channel. A remote attacker could send crafted HTTP requests to bypass GUI authentication. The supplied CVSS vector describes a network attack with low complexity, no required privileges, and no user interaction.

The advisory does not provide specific request paths, an exploit payload, or a detailed attack chain. Those limits matter when assessing exposure. Security teams should not assume that this flaw shares the same exploit method as earlier FortiSandbox authentication bypass vulnerabilities, which involved different components and vulnerability classes.

Affected Versions and Required Updates

FortiSandbox versions 5.0.0 through 5.0.6 are affected and require an upgrade to 5.0.7 or later. Versions 4.4.0 through 4.4.9 require an upgrade to 4.4.10 or later. FortiSandbox 5.2 is not affected.

For FortiSandbox PaaS, versions 5.0.0 through 5.0.6 require an upgrade to 5.0.7 or later. All PaaS 4.4 versions are affected, and Fortinet directs customers to migrate to a fixed release. PaaS 5.2 is not affected. No virtual patch is listed.

Fortinet credits Adham El Karn of its Product Security team with discovering and reporting the issue internally. The company also acknowledges Jason McFadyen of TrendAI Research for responsible disclosure.

A separate FortiSandbox sensitive data exposure vulnerability previously affected the web interface, but its fixes should not be treated as protection against this new flaw. Administrators should check their exact product and release against the new advisory before selecting an upgrade. This avoids confusing separate security fixes.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post Critical FortiSandbox GUI Vulnerability Allows Remote Attackers to Bypass Authentication appeared first on Cyber Security News.