Critical FortiSandbox Vulnerability Lets Remote Attackers Bypass Authentication and Execute Commands

Fortinet has disclosed a critical authentication bypass vulnerability in FortiSandbox that could let remote attackers access its web management interface without valid credentials and execute unauthorized code or commands.

This vulnerability is tracked as CVE-2026-107656 and affects multiple FortiSandbox and FortiSandbox PaaS releases. Administrators must upgrade vulnerable deployments to fixed versions.

Critical FortiSandbox Vulnerability

The advisory, designated FG-IR-26-185, was initially published on October 13, 2026. Fortinet assigns a CVSSv3 score of 9.6 to this vulnerability and classifies its severity as critical.

The affected component is the graphical user interface, where improper access control and session management create an alternate route around normal authentication checks.

Technically, the issue falls under “Authentication Bypass Using an Alternate Path or Channel” (CWE-288). According to the advisory, an unauthenticated attacker can exploit this weakness through specially crafted HTTP requests. The impact includes executing unauthorized code or commands, making it more significant than simply exposing the interface.

The CVSS vector indicates that the attack is network-accessible, requires low complexity, needs no privileges, and requires no user interaction, with high impacts on confidentiality, integrity, and availability.

These characteristics suggest that exploitation does not depend on gaining access to an existing account or convincing an administrator to interact with malicious content.

FortiSandbox versions 5.0.0 through 5.0.6 are affected, and administrators should upgrade to version 5.0.7 or later. The FortiSandbox 4.4 branch is vulnerable from versions 4.4.0 through 4.4.9, with remediation available in version 4.4.10 or later. Notably, the FortiSandbox 5.2 branch is not affected.

The affected cloud offering follows a similar pattern for its 5.0 branch. FortiSandbox PaaS versions 5.0.0 through 5.0.6 require an upgrade to version 5.0.7 or higher.

However, all FortiSandbox PaaS 4.4 versions are affected, so Fortinet advises customers to migrate to a fixed release. FortiSandbox PaaS 5.2 is confirmed to be unaffected.

Fortinet credits Adham El Karn from its Product Security team for discovering and reporting this vulnerability internally. The company also acknowledges Jason McFadyen of TrendAI Research for reporting the issue through responsible disclosure.

While these acknowledgments highlight the researchers involved, they do not confirm whether they worked independently or provide details on their investigation timelines.

At the time of publication, the advisory notes that the vulnerability is not known to be actively exploited. However, this designation should not be interpreted as evidence that exploitation is impossible or that vulnerable systems are safe.

Fortinet does not offer a virtual patch; therefore, the recommended remediation path is to follow the stated upgrade and migration guidance.

Security teams should identify affected deployments and prioritize remediating exposed management interfaces. While restricting administrative access can reduce exposure during the upgrade process, it should not replace installing a fixed release.

The advisory does not detail exploitation mechanics, indicators of compromise, or workarounds beyond its version-specific remediation guidance.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.