FG-IR-26-185: Improper access control and session management in the web management interface

Published Oct 13, 2026

Updated

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests.

Affected Software

4 affected componentsFixes available

Fortinet FortiSandbox>=5.0.0<=5.0.6

Fortinet FortiSandbox>=4.4.0<=4.4.9

Fortinet FortiSandbox PaaS>=5.0.0<=5.0.6

Fortinet FortiSandbox PaaS>=4.4

Event History

Oct 13, 2026

Advisory Published

via FortiGuard·12:00 AM

Data Sourced

via FortiGuard·12:00 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue?

A remote, unauthenticated attacker can exploit it by sending crafted HTTP requests to the FortiSandbox GUI. No user interaction or prior privileges are required.

What security impact could successful exploitation have?

The supplied severity vector indicates high impact to confidentiality, integrity, and availability. The vulnerability is rated critical with a 9.6 severity score.

Is FortiSandbox PaaS affected as well as FortiSandbox?

Yes. The affected software list includes both Fortinet FortiSandbox and Fortinet FortiSandbox PaaS.

FG-IR-26-185: Improper access control and session management in the web management interface

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What security impact could successful exploitation have?

Is FortiSandbox PaaS affected as well as FortiSandbox?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What security impact could successful exploitation have?

Is FortiSandbox PaaS affected as well as FortiSandbox?