All vulnerabilities
CVE-2026-107656

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox Pa

Fortinet FortiSandboxNetwork & edge
Open in ThreatlineRecord JSON
CVSS
9.6Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published26 Oct 2026Updated 26 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Timeline

  1. 25 Oct 2026, 18:34 UTCExploit code publicGitHub proof-of-concept repositories
  2. 26 Oct 2026, 13:45 UTCPublishedCVE List

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests

Text from CVE List

Affected versions 6

  • FortiSandboxaffected: 5.0.0 through 5.0.6CVE List
  • FortiSandboxaffected: 4.4.0 through 4.4.9CVE List
  • FortiSandboxaffected: 4.2.1 through 4.2.8CVE List
  • FortiSandbox PaaSaffected: 5.0.0 through 5.0.6CVE List
  • FortiSandbox PaaSaffected: 4.4.0 through 4.4.9CVE List
  • FortiSandbox PaaSaffected: 4.2.1 through 4.2.8CVE List

References 1