ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability
Published Oct 15, 2026
·Updated
This vulnerability allows remote attackers to bypass authentication on affected installations of Fortinet FortiSandbox. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-107656.
Affected Software
1 affected component
Fortinet FortiSandbox
Event History
Oct 15, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
No authentication is required. A remote attacker can exploit the vulnerability to bypass authentication on affected Fortinet FortiSandbox installations.
2
How severe is this vulnerability?
ZDI assigned a CVSS rating of 7.3. The reported risk score is 70.
3
Which identifier should be used to track this vulnerability?
The assigned CVE is CVE-2026-107656.