9.6
CriticalCVSS 3.1 · from fortinet
CVE-2026-107656
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox…
FortiSandbox · CWE-288 · CWE-288AffectedFortiSandbox, FortiSandbox PaaS
FixNo fix listed yet.
PublishedOct 26, 13:45 · fortinet
ScoredOct 26 · 9.6 · fortinet
Exploit code publicNone known · checked 22:18 UTC
ExploitedNone known · CISA KEV checked 22:30 UTC
What we know
No known exploitation. CISA KEV, checked 22:30 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 22:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests
From fortinet
Affected and fixed versions
ProductAffectedFixed inFortiSandbox5.0.0 – 5.0.6–FortiSandbox4.4.0 – 4.4.9–FortiSandbox4.2.1 – 4.2.8–FortiSandbox PaaS5.0.0 – 5.0.6–FortiSandbox PaaS4.4.0 – 4.4.9–FortiSandbox PaaS4.2.1 – 4.2.8–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known