Critical FortiSandbox GUI Vulnerability Allows Remote Authentication Bypass
Fortinet has disclosed a critical authentication bypass vulnerability, CVE-2026-107656, in its FortiSandbox GUI, rated CVSS 9.6, enabling remote attackers to execute unauthorized code.
Fortinet has issued a critical security advisory for a severe authentication bypass vulnerability affecting its FortiSandbox graphical user interface. Tracked as CVE-2026-107656, the flaw carries a high CVSSv3 score of 9.6, indicating a significant risk to affected systems. This vulnerability allows remote attackers to bypass authentication mechanisms by sending specially crafted HTTP requests, potentially leading to the execution of unauthorized code or commands on the compromised appliance.
The vulnerability is classified under CWE-288, Authentication Bypass Using an Alternate Path or Channel. The exploit is described as having low complexity, requiring no privileges, and no user interaction, making it accessible to a broad range of attackers. While the advisory does not detail specific exploit paths or payloads, the potential impact is severe, allowing unauthorized access to sensitive functions and system control.
This critical flaw impacts specific versions of FortiSandbox appliances and its Platform-as-a-Service (PaaS) offerings. For FortiSandbox appliances, versions 5.0.0 through 5.0.6 require an upgrade to 5.0.7 or later, and versions 4.4.0 through 4.4.9 must be updated to 4.4.10 or later. FortiSandbox version 5.2 is not affected by this vulnerability.
For FortiSandbox PaaS customers, versions 5.0.0 through 5.0.6 need to be upgraded to 5.0.7 or later. All PaaS 4.4 versions are also affected, and Fortinet strongly advises customers to migrate to a fixed release. Similar to the appliance versions, PaaS 5.2 is not impacted.
Fortinet's advisory explicitly states that exploitation is currently marked as "No," meaning there is no confirmed evidence of this vulnerability being actively exploited in the wild at the time of disclosure. However, given its critical severity and ease of exploitation, proactive patching is strongly recommended.
It is important for security teams to note that this vulnerability is distinct from previous FortiSandbox authentication bypass issues, which involved different components and vulnerability classes. Administrators should consult Fortinet advisory FG-IR-26-185 for precise details and ensure they are applying the correct patches for this specific CVE.
The discovery and responsible disclosure of CVE-2026-107656 are credited to Adham El Karn of Fortinet's Product Security team and Jason McFadyen of TrendAI Research. This collaborative effort highlights the ongoing importance of vendor and researcher partnerships in identifying and mitigating critical security risks.
Given the potential for significant compromise, organizations utilizing FortiSandbox appliances or PaaS solutions should prioritize applying the necessary updates to protect their environments from potential exploitation. The lack of active exploitation in the wild presents a window of opportunity for organizations to remediate this critical vulnerability before it can be leveraged by malicious actors.
This advisory from Fortinet PSIRT provides further details on the critical authentication bypass vulnerability (CVE-2026-107656) affecting FortiSandbox GUI. It specifies that the vulnerability is an instance of CWE-288, allowing remote, unauthenticated attackers to bypass authentication via crafted HTTP requests. The advisory also lists the affected versions, including FortiSandbox 5.2, 5.0, 4.4, and their PaaS counterparts, and confirms the critical CVSSv3 score of 9.6.
This advisory details a separate vulnerability, CVE-2026-106172, affecting the FortiSandbox and FortiSandbox Cloud API. Unlike the previously reported GUI vulnerability, this flaw is a Use of Hard-coded Cryptographic Key (CWE-321) that allows unauthenticated attackers to access specific API endpoints via crafted HTTP requests, carrying a CVSSv3 score of 4.9.