FortiSandbox and FortiSandbox PaaS authentication bypass allows unauthenticated code execution (CVE-2026-107656)

What happened

Fortinet's advisory describes an authentication bypass using an alternate path or channel in the FortiSandbox web management interface. A remote unauthenticated attacker can send crafted HTTP requests to bypass authentication and then execute unauthorised code or commands. The flaw carries a CVSS 3.1 score of 9.6: network-reachable, low attack complexity, no privileges and no user interaction required.

At the time of writing, Fortinet has not published a fixed release or workaround. The CVE record does not show active exploitation or public disclosure. The SSVC assessment marks the flaw as automatable with total technical impact.

Who is affected

FortiSandbox 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, and 4.2.1 through 4.2.8 are affected. FortiSandbox PaaS 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, and 4.2.1 through 4.2.8 are affected.

The vulnerable component is the web management GUI. FortiSandbox is a sandboxing and malware analysis product; deployments where the management interface is reachable from untrusted networks should treat this as urgent.

What to do now

1. Restrict access to the FortiSandbox web management interface now. Place it on a dedicated management network or require VPN access, and remove any direct internet exposure.
2. Review management access logs and administrative accounts for unexpected activity, since the flaw permits unauthenticated code execution.
3. Monitor Fortinet's FG-IR-26-185 advisory. No fixed version or workaround is currently listed, so containment is the immediate response.

How to detect it

Begin by confirming whether the FortiSandbox web management interface is reachable from untrusted networks. Because the flaw is triggered by crafted HTTP requests, review web access logs for unusual or malformed requests to the GUI and examine administrative actions that cannot be explained. Fortinet has not published specific indicators of compromise for this advisory.

Beyond the patch

This is a pre-authentication, network-reachable flaw in a security product's own management plane, so exposure control is the immediate priority. Our Virtual CISO Services can help identify and reduce exposed management interfaces, and Managed Detection & Response (MDR) can watch for the code execution and administrative activity that would follow a bypass. Keep monitoring Fortinet's advisory; no fixed release is listed yet.