Threat reportVulnerabilityTL-2026-3433
Critical FortiSandbox GUI Authentication Bypass (CVE-2026-107656)
Critical FortiSandbox GUI Authentication Bypass (TL-2026-3433), also tracked as FG-IR-26-185, is a critical-severity software vulnerability scored CVSS 9.6, first published 2026-10-13. It has no confirmed attribution, affects Fortinet FortiSandbox, references 4 CVEs (CVE-2026-107656, CVE-2026-39808, CVE-2026-25089), maps to 4 MITRE ATT&CK techniques (T1059, T1078, T1133), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 9.6/10Critical
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3433
- Threat ID
- TL-2026-3433
- Also known as
- FG-IR-26-185
- Severity
- CRITICAL
- CVSS
- 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, health, critical-infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
How Critical FortiSandbox GUI Authentication Bypass works
Fortinet FortiSandbox and FortiSandbox PaaS contain an authentication bypass in the web GUI (CWE-288) that unauthenticated remote attackers can trigger with crafted HTTP requests. Fortinet rates it CVSS 9.6 (network, low complexity, no privileges, no user interaction). No exploitation in the wild was reported at disclosure on 2026-10-13.
CVE-2026-107656 (Fortinet advisory FG-IR-26-185) is an Authentication Bypass Using an Alternate Path or Channel (CWE-288) in the FortiSandbox web management interface. A remote, unauthenticated attacker can send specially crafted HTTP requests to the GUI to circumvent authentication and reach protected functions. The Fortinet advisory lists the impact as unauthorized code or command execution; the public reporting describes only unauthorized access to protected functions, and no exploit mechanics are published.
Affected: FortiSandbox 5.0.0-5.0.6 (fixed in 5.0.7 and later), FortiSandbox 4.4.0-4.4.9 (fixed in 4.4.10 and later), FortiSandbox PaaS 5.0.0-5.0.6 (fixed in 5.0.7 and later), and all FortiSandbox PaaS 4.4 versions (migrate to a fixed release). FortiSandbox 5.2 and FortiSandbox PaaS 5.2 are not affected. No workaround is documented and no virtual patch is available, so upgrading is the only remediation.
The flaw was found internally by Adham El Karn of Fortinet Product Security and was also reported through responsible disclosure by Jason McFadyen of TrendAI Research. The advisory and the Cyber Security News article were both published on 2026-10-13. No exploitation in the wild, public proof-of-concept, or IOC was reported at that time. NVD returned no record for this CVE when queried, and it is not confirmed in CISA KEV in the sources reviewed. The advisory page gives the vector with temporal metrics (E:F/RL:O/RC:C) and a 9.6 score; the base metrics shown would normally score 9.8, so the score and vector were not reconciled and the vendor-stated 9.6 is used.
Context: FortiSandbox was the target of earlier 2026 vulnerabilities, including CVE-2026-39808 and CVE-2026-25089 (OS command injection, CVSS 9.1), which CISA added to KEV with a 2026-07-16 remediation deadline. CVE-2026-39813 (JRPC API path traversal leading to authentication bypass, CVSS 9.1) was fixed in the same releases (Qualys, 2026-06-17). This history indicates attacker interest in the product, but it is not evidence that CVE-2026-107656 is exploited.
MITRE ATT&CK techniques used in TL-2026-3433
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Defense Evasion
Persistence
Affected products and versions in Critical FortiSandbox GUI Authentication Bypass
Remediation for Critical FortiSandbox GUI Authentication Bypass
Patches
- FortiSandbox 5.0.7+
- FortiSandbox 4.4.10+
- FortiSandbox PaaS 5.0.7+
- Fortinet advisory FG-IR-26-185
Immediate actions
- Upgrade FortiSandbox 5.0.0-5.0.6 to 5.0.7 or later
- Upgrade FortiSandbox 4.4.0-4.4.9 to 4.4.10 or later
- Upgrade FortiSandbox PaaS 5.0.0-5.0.6 to 5.0.7 or later; migrate PaaS 4.4 to a fixed release
- Restrict network access to the FortiSandbox management GUI to trusted administrative networks until patched
Workarounds
- None documented by Fortinet; virtual patching is not available
Longer-term hardening
- Keep management interfaces off the internet and behind VPN or a management VLAN
- Monitor FortiSandbox GUI access logs for requests that reach protected pages without an authenticated session
CVEs associated with Critical FortiSandbox GUI Authentication Bypass
CVE-2026-107656, CVE-2026-39808, CVE-2026-25089, CVE-2026-39813
Weaknesses (CWE) in Critical FortiSandbox GUI Authentication Bypass
Timeline of Critical FortiSandbox GUI Authentication Bypass
- Qualys reports exploitation of earlier FortiSandbox flaws CVE-2026-39808 and CVE-2026-25089 (OS command injection) and CVE-2026-39813 (JRPC auth bypass); fixed in 4.4.9 and 5.0.6. Related context only.
- CISA remediation deadline for the earlier FortiSandbox KEV entries CVE-2026-39808 and CVE-2026-25089.
- NVD API returned no record for CVE-2026-107656 and no CISA KEV listing was confirmed at research time; the advisory lists no workaround or virtual patch, so upgrade is the only remediation.
- Fortinet states all FortiSandbox PaaS 4.4 versions are affected with no in-line fix; customers must migrate to a fixed release. FortiSandbox 5.2 and PaaS 5.2 are not affected.
- Cyber Security News reports the flaw and states no known exploitation in the wild at disclosure.
- Fixed releases FortiSandbox 5.0.7+, 4.4.10+ and PaaS 5.0.7+ made available; FortiSandbox 5.2 and PaaS 5.2 are not affected; no workaround or virtual patch.
- Fortinet publishes advisory FG-IR-26-185 for CVE-2026-107656, a CVSS 9.6 FortiSandbox GUI authentication bypass (CWE-288), internally discovered by Adham El Karn and also reported by Jason McFadyen of TrendAI Research.
Sources cited for Critical FortiSandbox GUI Authentication Bypass
- Critical FortiSandbox GUI Vulnerability Allows Remote Attackers to Bypass Authentication
- Fortinet PSIRT Advisory FG-IR-26-185
- NVD API query for CVE-2026-107656 (no record at time of research)
- Qualys ThreatPROTECT: Fortinet FortiSandbox Vulnerability Exploited by Attackers (CVE-2026-39808, CVE-2026-25089, CVE-2026-39813)
- CISA Known Exploited Vulnerabilities Catalog
Detection coverage for TL-2026-3433
As of 2026-10-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3433 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.