FortiSandbox Auth Bypass via Alternate Path Channel
Authentication bypass via alternate path in Fortinet FortiSandbox, CVSS 9.8 critical. Affects versions 5.0.0-5.0.6, 4.4.0-4.4.9, and all 4.2 releases.
- Vendor
- Fortinet
- Product
- FortiSandbox (5.0.x through 5.0.6, 4.4.x through 4.4.9, 4.2 all versions)
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Is CVE-2026-107656 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-107656 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-27 snapshot. That can change quickly; check the write-up below for the latest reporting.
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-27. Full cross-catalog view: /kev-comparison
CVE-2026-107656 timeline
- Published to NVD
- Patch availablesame day as NVDFortinet advisory FG-IR-26-185 published with fixed versions
- First 0dayNews coverage+1d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-107656 is an authentication bypass via alternate path or channel (CWE-288) in the Fortinet FortiSandbox appliance, rated CVSS 9.8 critical by NVD.
An unauthenticated attacker with network access to the appliance can bypass authentication controls by reaching the affected endpoint through an alternate path. Fortinet’s advisory (FG-IR-26-185) covers three active branches: 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, and all 4.2 versions.
FortiSandbox is a network traffic analysis and sandboxing appliance typically deployed on the security perimeter for malware inspection. An authentication bypass on a perimeter appliance at CVSS 9.8 exposes the management interface to unauthenticated access.
Exploitation status: unconfirmed at time of publication.
Remediation: Upgrade to a fixed release per FortiGuard advisory FG-IR-26-185. Fixed version details are in the advisory.
Sources: NVD, FortiGuard PSIRT FG-IR-26-185.
Other Fortinet CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2025-61624 Fortinet Multiple Products Path Traversal Vulnerability | [ MEDIUM ] | 6.0 | 1.3% | |
| CVE-2026-106173 Fortinet FortiSIEM and FortiSandbox GUI Unauthenticated RCEwrite-up | [ CRITICAL ] | 9.8 | 1.0% | — |
| CVE-2026-104286 Fortinet FortiMail Path Traversal and NULL Byte Flawwrite-up | [ CRITICAL ] | 9.8 | 4.6% | |
| CVE-2025-25249 Fortinet Multiple Products Heap-based Buffer Overflow Vulnerabilitywrite-up | [ HIGH ] | 8.1 | 3.7% | |
| CVE-2026-70468 FortiManager Authentication Bypass via Alternate Pathwrite-up | [ HIGH ] | 8.1 | 0.5% | — |
| CVE-2026-26035 FortiWeb Authentication Bypass Allows Unauthenticated Loginwrite-up | [ CRITICAL ] | 9.8 | 0.8% | — |
| CVE-2025-68686 FortiOS patch bypass re-enables symbolic link persistence on compromised deviceswrite-up | [ MEDIUM ] | 5.9 | 29.5% | |
| CVE-2026-39808 Fortinet FortiSandbox unauthenticated OS command injection (4.4 branch and PaaS)write-up | [ CRITICAL ] | 9.8 | 93.2% |
