ZDI-CAN-31870: ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability
Published Oct 15, 2026
·Updated
This vulnerability allows remote attackers to bypass authentication on affected installations of Fortinet FortiSandbox. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-107656.
Affected Software
1 affected component
Fortinet FortiSandbox
Event History
Oct 15, 2026
Advisory Published
via ZDI·05:00 AM
Data Sourced
via ZDI·05:00 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
A remote attacker can exploit it without authentication on affected Fortinet FortiSandbox installations.
2
Does exploitation require valid credentials or prior access?
No. The vulnerability is an authentication bypass, and authentication is not required to exploit it.
3
Which identifier should be used to track this vulnerability?
The assigned CVE is CVE-2026-107656. ZDI tracks it as ZDI-26-771.