FG-IR-26-179: Fabric API Authentication bypass

Published Oct 13, 2026

Updated

A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted HTTP requests

Affected Software

6 affected componentsFixes available

Fortinet FortiSandbox>=5.2.0<=5.2.1

Fortinet FortiSandbox>=5.0.0<=5.0.6

Fortinet FortiSandbox>=4.4

Fortinet FortiSandbox Cloud>=5.2.0<=5.2.1

Fortinet FortiSandbox Cloud>=5.0.0<=5.0.6

Fortinet FortiSandbox Cloud>=4.4

Event History

Oct 13, 2026

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What access does an attacker need to attempt exploitation?

No prior authentication or user interaction is required. An attacker must be able to send specially crafted HTTP requests to the affected FortiSandbox or FortiSandbox Cloud API.

What is the documented impact if exploitation succeeds?

The issue may allow access to some API endpoints. The provided severity vector indicates a low confidentiality impact and no stated integrity or availability impact.

FG-IR-26-179: Fabric API Authentication bypass

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to attempt exploitation?

What is the documented impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to attempt exploitation?

What is the documented impact if exploitation succeeds?