FortiSandbox authentication bypass may allow unauthenticated code execution (CVE-2026-107656)

What happened

Fortinet's advisory FG-IR-26-185 describes an authentication bypass using an alternate path or channel (CWE-288) in the FortiSandbox GUI. The flaw is reachable over the network without credentials and without user interaction. An attacker can send crafted HTTP requests to bypass authentication, and the CVE record states this may allow execution of unauthorized code or commands. The CVSS 3.1 score is 9.6 (Critical), with high impact on confidentiality, integrity and availability.

The CVE record shows no public disclosure and no known exploitation, and the flaw is not listed in CISA KEV. Fortinet has not published a vendor workaround or a fixed release. Treat the management interface as unauthenticated until Fortinet publishes a fixed version.

Who is affected

The vulnerable component is the FortiSandbox GUI/web management interface. Affected versions listed in the vendor advisory are:

• FortiSandbox 5.0.0 through 5.0.6
• FortiSandbox 4.4.0 through 4.4.9
• FortiSandbox 4.2.1 through 4.2.8
• FortiSandbox PaaS 5.0.0 through 5.0.6
• FortiSandbox PaaS 4.4.0 through 4.4.9
• FortiSandbox PaaS 4.2.1 through 4.2.8

FortiSandbox is a sandboxing product; FortiSandbox PaaS is its platform-as-a-service deployment. Organisations that expose the management GUI to users or to the internet should consider themselves affected.

What to do now

1. No fixed release or vendor workaround is listed for CVE-2026-107656. Isolate the FortiSandbox and FortiSandbox PaaS management GUI from untrusted networks immediately, allowing access only from a dedicated internal management network or VPN.
2. Remove internet-facing or third-party access to the management interface where possible.
3. Monitor Fortinet's FG-IR-26-185 advisory for a fixed release, and apply it as soon as Fortinet publishes one.
4. Increase monitoring of the management interface for unusual logins, new sessions, or unexpected commands, and investigate any anomalies.

How to detect it

Concentrate on the web management interface. Review access logs for unexpected authenticated sessions or command activity, monitor for crafted HTTP requests to the GUI, and look for new or modified administrator accounts. The vendor advisory does not provide specific indicators of compromise.

Beyond the patch

An authentication bypass on a network-facing management interface is an exposure problem before it is anything else. Virtual CISO Services (vCISO) can help map and reduce exposed management interfaces you may not be tracking. After access is obtained, code execution and credential abuse leave a trail; Managed Detection & Response (MDR) is built to detect that follow-on activity. With no fixed release published yet, the right posture is to restrict exposure and watch for misuse.