Critical FortiSandbox GUI Vulnerability Allows Remote Attackers to Bypass Authentication

Fortinet disclosed a critical authentication-bypass vulnerability in the FortiSandbox graphical user interface that could let remote attackers access protected functions without valid credentials. Tracked as CVE-2026-107656, the flaw carries a reported CVSSv3 score of 9.6 and affects both FortiSandbox appliances and selected FortiSandbox PaaS releases. Published on October 13, 2026, the disclosure is tracked under Fortinet advisory FG-IR-26-185. Fortinet lists the potential impact as execution of unauthorized code or commands. Its advisory marks known exploitation as “No,” meaning the disclosure does not establish that attackers have already used this vulnerability in real attacks. The weakness is classified as CWE-288,...

Læs hele artiklen hos kilden.