Fortinet has announced a critical vulnerability in the FortiSandbox graphical user interface that could allow remote attackers to access administrative functions without needing valid credentials. Identified as CVE-2026-107656, this flaw has a high severity CVSSv3 score of 9.6 and impacts both FortiSandbox appliances and certain FortiSandbox PaaS versions. The issue was disclosed on October 13, 2026, under Fortinet advisory FG-IR-26-185. While the advisory indicates no known exploitation in the wild, the potential consequences include execution of unauthorized code or commands.
The vulnerability is classified under CWE-288, which relates to authentication bypass using an alternate path or channel. Attackers could exploit this by sending crafted HTTP requests to bypass the GUI authentication. The CVSS vector indicates that the attack can be executed over a network with low complexity, requiring no privileges or user interaction. However, the advisory does not specify request paths, exploit payloads, or detailed attack chains, which are crucial for understanding exposure levels.
FortiSandbox versions 5.0.0 to 5.0.6 need to be upgraded to 5.0.7 or later, while versions 4.4.0 to 4.4.9 should be updated to 4.4.10 or later. Version 5.2 remains unaffected. For FortiSandbox PaaS, versions 5.0.0 to 5.0.6 require an upgrade to 5.0.7 or later, and all versions of PaaS 4.4 are vulnerable, necessitating migration to a fixed release. Notably, PaaS 5.2 is not impacted. Fortinet has not issued a virtual patch for this vulnerability.
The vulnerability was discovered internally by Adham El Karn from Fortinet's Product Security team, with additional responsible disclosure by Jason McFadyen of TrendAI Research. It's important to differentiate this flaw from a previous data exposure vulnerability affecting the FortiSandbox web interface, as the fixes for the previous issue do not cover this new one. Administrators must verify their specific product and version against the latest advisory to ensure they select the appropriate upgrade.
