# Critical FortiSandbox GUI Authentication Bypass (CVE-2026-107656)

> Fortinet FortiSandbox and FortiSandbox PaaS contain an authentication bypass in the web GUI (CWE-288) that unauthenticated remote attackers can trigger with crafted HTTP requests. Fortinet rates it CVSS 9.6 (network, low complexity, no privileges, no user interaction). No exploitation in the wild was reported at disclosure on 2026-10-13.

- **Published:** 2026-10-13T18:09:56Z
- **Last reviewed:** 2026-10-13T18:09:56Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3433
- **ID:** TL-2026-3433
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-107656, CVE-2026-39808, CVE-2026-25089, CVE-2026-39813

## Description

CVE-2026-107656 (Fortinet advisory FG-IR-26-185) is an Authentication Bypass Using an Alternate Path or Channel (CWE-288) in the FortiSandbox web management interface. A remote, unauthenticated attacker can send specially crafted HTTP requests to the GUI to circumvent authentication and reach protected functions. The Fortinet advisory lists the impact as unauthorized code or command execution; the public reporting describes only unauthorized access to protected functions, and no exploit mechanics are published.

Affected: FortiSandbox 5.0.0-5.0.6 (fixed in 5.0.7 and later), FortiSandbox 4.4.0-4.4.9 (fixed in 4.4.10 and later), FortiSandbox PaaS 5.0.0-5.0.6 (fixed in 5.0.7 and later), and all FortiSandbox PaaS 4.4 versions (migrate to a fixed release). FortiSandbox 5.2 and FortiSandbox PaaS 5.2 are not affected. No workaround is documented and no virtual patch is available, so upgrading is the only remediation.

The flaw was found internally by Adham El Karn of Fortinet Product Security and was also reported through responsible disclosure by Jason McFadyen of TrendAI Research. The advisory and the Cyber Security News article were both published on 2026-10-13. No exploitation in the wild, public proof-of-concept, or IOC was reported at that time. NVD returned no record for this CVE when queried, and it is not confirmed in CISA KEV in the sources reviewed. The advisory page gives the vector with temporal metrics (E:F/RL:O/RC:C) and a 9.6 score; the base metrics shown would normally score 9.8, so the score and vector were not reconciled and the vendor-stated 9.6 is used.

Context: FortiSandbox was the target of earlier 2026 vulnerabilities, including CVE-2026-39808 and CVE-2026-25089 (OS command injection, CVSS 9.1), which CISA added to KEV with a 2026-07-16 remediation deadline. CVE-2026-39813 (JRPC API path traversal leading to authentication bypass, CVSS 9.1) was fixed in the same releases (Qualys, 2026-06-17). This history indicates attacker interest in the product, but it is not evidence that CVE-2026-107656 is exploited.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1078 Valid Accounts

## Sources

- [Critical FortiSandbox GUI Vulnerability Allows Remote Attackers to Bypass Authentication](https://cybersecuritynews.com/fortisandbox-gui-vulnerability/)
- [Fortinet PSIRT Advisory FG-IR-26-185](https://fortiguard.fortinet.com/psirt/FG-IR-26-185)
- [NVD API query for CVE-2026-107656 (no record at time of research)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-107656)
- [Qualys ThreatPROTECT: Fortinet FortiSandbox Vulnerability Exploited by Attackers (CVE-2026-39808, CVE-2026-25089, CVE-2026-39813)](https://threatprotect.qualys.com/2026/06/17/fortinet-fortisandbox-vulnerability-exploited-by-attackers-cve-2026-39808-cve-2026-25089-cve-2026-39813/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3433