Fortinet published FG-IR-26-185 on 13 October 2026 for CVE-2026-107656, an authentication bypass in the FortiSandbox web management interface. Fortinet rates it critical, CVSS 9.6, and says a remote unauthenticated attacker can bypass authentication with crafted HTTP requests. Fortinet lists known exploited as no.
What happened
The weakness is CWE-288, authentication bypass using an alternate path or channel. Fortinet found it internally. TrendAI Research also reported it. Impact in the advisory is execute unauthorized code or commands. There is no virtual patch.
The 5.2 branch of FortiSandbox and FortiSandbox PaaS is not affected. Older management interfaces are.
Who is affected
- FortiSandbox 5.0.0 through 5.0.6. Upgrade to 5.0.7 or above.
- FortiSandbox 4.4.0 through 4.4.9. Upgrade to 4.4.10 or above.
- FortiSandbox PaaS 5.0.0 through 5.0.6. Upgrade to 5.0.7 or above.
- FortiSandbox PaaS 4.4, all versions. Migrate to a fixed release.
What to do now
Upgrade the affected FortiSandbox release this week and keep the management GUI off the internet. Confirm the running version before you assume 5.2 covers you. If the GUI was exposed, review authentication logs for unexpected sessions after 13 October. Fortinet has not reported exploitation in the wild.
Source: Fortinet PSIRT, FG-IR-26-185.
Also on the blog
- Chrome 155 patches 37 flaws, 7 critical
- OpenAI employee arrested over hidden conference-room recorder
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.