CVE-2026-107656
FortiSandbox: Execute unauthorized code or commands
- Severity
- 9.6CVSSv3.1
- Exploitation
- None seen No known exploitation
- EPSS
- —no estimate
- Products
- 2no fix yet
No known exploitation, and no fixed version published yet.
An attacker can bypass authentication with crafted HTTP requests to FortiSandbox 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, 4.2 all versions, and FortiSandbox PaaS 5.0.0 through 5.0.6, 4.4 all versions, 4.2 all versions, and run unauthorized code or commands. The flaw scores CVSSv3.1 9.6 and is listed as none-observed for exploitation, so patch scheduling should follow your normal critical-severity cycle. Confirm fixed versions against the Fortinet advisory, since the structured source lists none.
What to do
No fixed version is published yet. Apply vendor mitigations or isolate the affected products.
| Product | Fixed version |
|---|---|
| FortiSandbox | none published |
| FortiSandbox PaaS | none published |
Why it matters
Scores 9.6 out of 10 (CVSSv3.1). That is remote damage without needing an account.
If you run any of the 2 products above and cannot patch today, assume it will be targeted and restrict access in the meantime.
Exploitation
- Status
- No known exploitation
Analysis
Public sources, summarised. This is context for your decision. The facts above are the ones to act on.
| Source | Adds | Summary |
|---|---|---|
| Mandiant Source 2026-10-15 | — | This vulnerability allows remote attackers to bypass authentication on affected installations of Fortinet FortiSandbox. Authentication is not required to exploit this vulnerability. The ZDI has assign |
Vendor references
Published
2026-10-26 18:12 UTC · last updated 2026-10-26 18:11 UTC