Live › vulnerability › CVE-2026-107656
Go to dashboardFortiSandbox has an authentication bypass through an alternate path, affecting versions 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, and 4.2 (all), plus the matching PaaS releases. An attacker sending crafted HTTP requests can run unauthorized code or commands on the appliance without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Organizations running FortiSandbox appliances or FortiSandbox PaaS in the affected version ranges. Sources do not say whether the HTTP interface must be reachable from the internet or only from internal networks, and do not give a fixed version.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests
This page as .md · .json · in your agent: get_signal("CVE-2026-107656")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.