{"id":"CVE-2026-107656","kind":"vulnerability","aliases":["CVE-2026-107656"],"related":[],"title":"Fortinet FortiSandbox: authentication bypass lets crafted HTTP requests run commands","description":"An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests","summary":"FortiSandbox has an authentication bypass through an alternate path, affecting versions 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, and 4.2 (all), plus the matching PaaS releases. An attacker sending crafted HTTP requests can run unauthorized code or commands on the appliance without logging in.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["appliance","fortinet","fortisandbox","infrastructure","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-26T14:16:24+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","triaged_at":"2026-10-26T14:32:03+00:00","updated_at":"2026-10-26T14:32:03+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-26T14:32:03Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Fortinet FortiSandbox: authentication bypass lets crafted HTTP requests run commands","impact":"high","summary":"FortiSandbox has an authentication bypass through an alternate path, affecting versions 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, and 4.2 (all), plus the matching PaaS releases. An attacker sending crafted HTTP requests can run unauthorized code or commands on the appliance without logging in.","category":"infrastructure","nicknames":[],"who_cares":["fortisandbox","fortinet","appliance","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs unauthorized commands on the sandbox appliance without credentials.","analyst_note":"Find Fortinet's advisory for CVE-2026-107656 to confirm fixed versions, the affected HTTP interface, and any workaround; a public PoC repo is linked, so check exposure and whether it is exploited.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running FortiSandbox appliances or FortiSandbox PaaS in the affected version ranges. Sources do not say whether the HTTP interface must be reachable from the internet or only from internal networks, and do not give a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000604,"input_tokens":3442,"output_tokens":519,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-107656':13A,16A '-2026':12A,15A '4.2':42B,87C,102C '4.4':97C '4.4.0':38B,83C '4.4.9':40B,85C '5.0.0':35B,79C,92C '5.0.6':37B,81C,94C 'affect':33B 'allow':106C 'altern':31B,71C 'applianc':17B,63B 'attack':50B,107C 'authent':3A,27B,67C 'bypass':4A,28B,68C 'channel':74C 'code':58B,111C 'command':10A,60B,113C 'craft':6A,52B,115C 'cve':11A,14A 'execut':109C 'fortinet':1A,18B,77C 'fortisandbox':2A,19B,24B,78C,82C,86C,90C,95C,100C 'host':23B 'http':7A,53B,116C 'infrastructur':20B 'let':5A 'log':65B 'match':46B 'may':105C 'paa':47B,91C,96C,101C 'path':32B,72C 'plus':44B 'releas':48B 'request':8A,54B,117C 'run':9A,56B 'self':22B 'self-host':21B 'send':51B 'unauthor':57B,110C 'use':69C 'version':34B,89C,99C,104C 'via':114C 'vulner':75C 'without':64B","nicknames":[],"mitigations":[],"who_affected":"Organizations running FortiSandbox appliances or FortiSandbox PaaS in the affected version ranges. Sources do not say whether the HTTP interface must be reachable from the internet or only from internal networks, and do not give a fixed version.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-25T18:34:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@fortinet.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-107656","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107656","severity":null,"published_at":"2026-10-26T14:16:24+00:00","modified_at":"2026-10-26T14:16:24+00:00","first_seen_at":"2026-10-26T14:30:36+00:00","fetched_at":"2026-10-26T14:30:36+00:00","note":null}],"documents":[{"id":3576,"url":"https://github.com/Ghost-Bx1/Fortinet-Exploits-CVE-2026-39808-106173-107656","title":"Ghost-Bx1/Fortinet-Exploits-CVE-2026-39808-106173-107656","kind":"poc","source":"github","text":"PoC e Exploits completos para CVE-2026-39808 (FortiSandbox RCE), CVE-2026-106173 (FortiSIEM gRPC Path Traversal RCE) e CVE-2026-107656 (FortiSandbox Auth Bypass) - CVSS 9.6-9.8\n\nstars 0","published_at":"2026-10-25T18:34:17+00:00","relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}