Fortinet FortiSandbox: Authentication bypass in GUI allows unauthorized code execution

Summary

FortiSandbox appliances, VMs and PaaS instances contain an authentication bypass (CWE-288) in the web management GUI. A remote, unauthenticated attacker can send crafted HTTP requests to bypass authentication and execute unauthorized code or commands. No credentials or user interaction are needed, so MFA and strong passwords do not prevent this attack. Fortinet rates it critical (CVSS 9.6); the NVD vector gives 9.8.

Affected

• FortiSandbox 5.0.0 to 5.0.6
• FortiSandbox 4.4.0 to 4.4.9
• FortiSandbox 4.2 (CVE description says all versions; CNA lists 4.2.1 to 4.2.8; Fortinet advisory has no 4.2 row, so confirm with Fortinet)
• FortiSandbox PaaS 5.0.0 to 5.0.6
• FortiSandbox PaaS 4.4 (all versions)
• FortiSandbox PaaS 4.2 (all versions per CVE description)
• Not affected: FortiSandbox 5.2 and FortiSandbox PaaS 5.2

Fixed in

• FortiSandbox 5.0: upgrade to 5.0.7 or later
• FortiSandbox 4.4: upgrade to 4.4.10 or later
• FortiSandbox PaaS 5.0: upgrade to 5.0.7 or later
• FortiSandbox 5.2.0 or later (listed as solution by the CNA)
• FortiSandbox 4.2 and PaaS 4.4: Unknown. No fixed version is listed; migrate to a fixed release and confirm the path with Fortinet support.

Workaround

• No virtual patch is listed by Fortinet.
• Remove internet exposure of the management GUI and limit access to admin networks, verified from all plausible network paths.
• Monitor for unusual HTTP requests to the management interface.
• Fixes for other FortiSandbox GUI issues do not protect against this flaw.

Exploitation

• Fortinet: not known to be exploited.
• CISA KEV: not verified by the authors; one source reported no listing as of 2026-10-15.
• A public GitHub repository claims exploit code for this CVE. It is unverified and may be malicious; do not run it.
• Helix reports temporal score E:F (functional exploit available) with no confirmed in-the-wild exploitation.
• Other 2026 FortiSandbox flaws are reported as actively exploited; these are different CVEs.

Our recommendation

• Inventory all FortiSandbox appliances, VMs and PaaS instances, including standby and DR systems.
• Remove any internet exposure of the GUI now and restrict management access to admin networks.
• Upgrade 5.0 to 5.0.7 or later and 4.4 to 4.4.10 or later; verify against the live advisory.
• Plan migration for 4.2 and PaaS 4.4 and confirm the fix path with Fortinet.
• Review logs for unusual HTTP requests and signs of compromise; do not run unverified public exploit code.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Fortinet PSIRT FG-IR-26-185 fortiguard.fortinet.com
• FortiGuard PSIRT FG-IR-26-185 (www) www.fortiguard.com
• Strix AI CVE listing (CNA-derived versions) www.strix.ai
• ThreatFrontier article on CVE-2026-107656 threatfrontier.com
• AboutInfoSec analysis of FortiSandbox auth bypass aboutinfosec.com
• Helix threat watch on FortiSandbox auth bypass flaws helix.ml
• Kudelski Security on active Fortinet exploitation kudelskisecurity.com
• Cyberpress report on critical FortiSandbox flaw cyberpress.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:35.