Fortinet Patches CVSS 9.8 Auth Bypass in FortiSandbox
CVE-2026-107656, a CVSS 9.8 authentication bypass in Fortinet FortiSandbox, affects three active branches. No active exploitation confirmed at publication.
Morgan "airgap" ReyesAuth bypass patched in Fortinet FortiSandbox. CVE-2026-107656 carries a CVSS 9.8 critical rating. Fortinet published advisory FG-IR-26-185 on 2026-10-26.
The flaw (CWE-288: authentication bypass via alternate path or channel) lets an unauthenticated attacker with network access reach protected functionality through an alternate path, bypassing authentication controls. Three active release branches are affected: FortiSandbox 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, and all 4.2 versions.
Exploitation status: unconfirmed at time of publication. No mention of active exploitation appears in the FortiGuard PSIRT advisory.
What this is
FortiSandbox is Fortinet’s network traffic inspection and behavioral malware analysis appliance, positioned at the perimeter within the Fortinet Security Fabric. An unauthenticated bypass at CVSS 9.8 on a perimeter device with this level of network access carries significant blast radius.
This is the second Fortinet sandbox-adjacent advisory in October. Earlier this month, a PoC for a critical FortiSIEM RCE flaw went public. UNC5820 chained Fortinet flaws in an ongoing telecom campaign documented in October as well.
Affected versions
- FortiSandbox 5.0.x: 5.0.0 through 5.0.6 are affected.
- FortiSandbox 4.4.x: 4.4.0 through 4.4.9 are affected.
- FortiSandbox 4.2.x: all versions are affected.
Fixed versions are listed in FortiGuard advisory FG-IR-26-185. The advisory confirms fixed releases for all three branches and includes hardening guidance on management interface segmentation.
- [ CRITICAL ]CVE-2026-107656FortiSandbox Auth Bypass via Alternate Path Channel
Found this useful? Share it.
