CVE-2026-107656: Critical severity Fortinet FortiSandbox vulnerability

Q: Does an attacker need credentials or user interaction to exploit this issue?

No. The CVSS vector indicates that exploitation requires no privileges and no user interaction, using crafted HTTP requests over the network.

Q: What is the likely security impact if exploitation succeeds?

The vulnerability may allow unauthorized code or command execution. The CVSS impacts rate confidentiality, integrity, and availability as high.

Published Oct 26, 2026

Updated

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests

Affected Software

2 affected components

Fortinet FortiSandbox>=5.0.0<=5.0.6, >=4.4.0<=4.4.9

Fortinet FortiSandbox PaaS>=5.0.0<=5.0.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Fortinet FortiSandbox PaaS to a version that resolves this vulnerability.
Fixed in 5.0.7
Upgrade
Upgrade Fortinet FortiSandbox to a version that resolves this vulnerability.
Fixed in 4.4.10
Upgrade
Upgrade Fortinet FortiSandbox to a version that resolves this vulnerability.
Fixed in 5.0.7
Upgrade
Upgrade Fortinet FortiSandbox to a version that resolves this vulnerability.
Fixed in 5.2.0

Event History

Oct 26, 2026

CVE Published

via MITRE·01:45 PM

Data Sourced

via MITRE·01:45 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Does an attacker need credentials or user interaction to exploit this issue?

No. The CVSS vector indicates that exploitation requires no privileges and no user interaction, using crafted HTTP requests over the network.

What is the likely security impact if exploitation succeeds?