---
id: "CVE-2026-107656"
kind: "vulnerability"
aliases: ["CVE-2026-107656"]
title: "Fortinet FortiSandbox: authentication bypass lets crafted HTTP requests run commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["appliance", "fortinet", "fortisandbox", "infrastructure", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-10-26T14:16:24+00:00"
first_seen_at: "2026-10-26T14:30:36+00:00"
updated_at: "2026-10-26T14:32:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107656", "first_seen_at": "2026-10-26T14:30:36+00:00"}]
---

# Fortinet FortiSandbox: authentication bypass lets crafted HTTP requests run commands

FortiSandbox has an authentication bypass through an alternate path, affecting versions 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, and 4.2 (all), plus the matching PaaS releases. An attacker sending crafted HTTP requests can run unauthorized code or commands on the appliance without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-26T14:30:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107656

## Documents

- [poc] Ghost-Bx1/Fortinet-Exploits-CVE-2026-39808-106173-107656 https://github.com/Ghost-Bx1/Fortinet-Exploits-CVE-2026-39808-106173-107656

## From the sources

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_