Fortinet FortiSandbox: two authentication bypass flaws in GUI and Fabric API allow unauthenticated attackers to access the management interface and API endpoints (CVE-2026-107656, CVE-2026-106172)
Severity: critical · Patch status: patched · Since 2026-10-13 · CVE-2026-106172, CVE-2026-107656
On 2026-10-13 Fortinet published two PSIRT advisories for FortiSandbox and FortiSandbox Cloud. FG-IR-26-185 (CVE-2026-107656, CVSS 9.6) is an authentication bypass via alternate path (CWE-288) in the GUI letting a remote unauthenticated attacker bypass authentication with crafted HTTP requests, potentially executing unauthorized code; it affects FortiSandbox 4.4, 5.0 and 5.2 and the PaaS offering. FG-IR-26-179 (CVE-2026-106172, CVSS 4.9) is a hard-coded cryptographic key (CWE-321) in the Fabric API allowing unauthenticated access to some endpoints and privilege escalation, affecting dozens of FortiSandbox and FortiSandbox Cloud releases from 4.4.0 through 5.2.1. Both were reported via responsible disclosure (Fortinet, TrendAI Research, watchTowr). Fixes are available (RL:O) and CVSS E:F suggests functional exploits exist; no in-the-wild exploitation is confirmed.
What to do
- Upgrade FortiSandbox and FortiSandbox Cloud/PaaS to the fixed releases referenced in FG-IR-26-185 and FG-IR-26-179 immediately, prioritising internet-exposed management interfaces
- Restrict access to the FortiSandbox GUI and Fabric API to trusted management networks and disable direct internet exposure
- Review logs for unauthenticated access to the GUI and Fabric API endpoints and rotate any Fabric API credentials/integration keys
- If running FortiSandbox as part of a security stack (e.g., feeding FortiGate/FortiMail), verify integrity of sandbox verdicts and monitor for signs of tampering
Sources
All live incidents on Threat Watch
