Critical FortiSandbox GUI Vulnerability Allows Remote Attackers to Bypass Authentication

What happened?

Fortinet disclosed a critical authentication-bypass vulnerability in the FortiSandbox graphical user interface that could let remote attackers access protected functions without valid credentials. Tracked as CVE-2026-107656, the flaw carries a reported CVSSv3 score of 9.6 and affects both FortiSandbox appliances and selected FortiSandbox PaaS releases. Published on October 13, 2026, the disclosure is tracked under Fortinet advisory FG-IR-26-185. Fortinet lists the potential impact as execution of unauthorized code or commands.

Key details

• Fortinet disclosed a critical authentication bypass in the FortiSandbox GUI allowing remote attackers to access protected functions without credentials.
• The vulnerability is tracked as CVE-2026-107656 with a CVSSv3 score of 9.6 and classified as CWE-288.
• A remote attacker can send crafted HTTP requests to bypass GUI authentication over the network with low complexity and no privileges or user interaction.
• Fortinet states there is no known exploitation of this vulnerability in real attacks.
• The advisory does not provide specific request paths, exploit payloads, or detailed attack chains.
• Fortinet credits Adham El Karn of its Product Security team and Jason McFadyen of TrendAI Research for discovering and reporting the issue.
• A previous sensitive data exposure vulnerability in the FortiSandbox web interface is separate and its fixes do not protect against this new flaw.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.