A crafted HTTP request can pass the login check on affected FortiSandbox management interfaces. Fortinet’s October 13 advisory rates CVE-2026-107656 Critical and lists execution of unauthorized code or commands as the impact. Teams running the affected appliance or PaaS releases need to identify the branch and change where the GUI can be reached while upgrading.
Fortinet says the flaw “may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests.” Its advisory marks known exploitation No.
One-minute read: Check FortiSandbox 5.0.0–5.0.6 and 4.4.0–4.4.9, plus FortiSandbox PaaS 5.0.0–5.0.6 and every PaaS 4.4 release. Upgrade the appliance branches to 5.0.7 or 4.4.10 respectively; upgrade PaaS 5.0 to 5.0.7 or above and migrate PaaS 4.4 to a fixed release. Limit GUI access to trusted administration paths and verify that an untrusted network cannot connect.
Crafted requests reach the GUI
The affected component is the FortiSandbox GUI, the management interface operators use to control the sandbox. Fortinet classifies the weakness as authentication bypass using an alternate path or channel (CWE-288), with improper access control and session management in the web interface. A remote caller able to send the crafted requests can get past authentication; the vendor lists unauthorized code or command execution as the resulting impact. Protecting a sandbox’s analysis network alone would leave its management path exposed if other clients can still reach that GUI.
Review GUI access records for unexpected source addresses and times, then correlate each lead with appliance activity and network connection logs. The advisory provides no request-level exploit indicator, so corroborate unusual access before treating it as suspected exploitation. Fortinet lists “Virtual Patch” as “No,” so plan a product upgrade and a management-network access restriction.
Match each branch to its fix
Fortinet’s affected-version table gives different answers for FortiSandbox appliance and PaaS releases:
- FortiSandbox
5.0.0through5.0.6: upgrade to5.0.7or above. - FortiSandbox
4.4.0through4.4.9: upgrade to4.4.10or above. - FortiSandbox PaaS
5.0.0through5.0.6: upgrade to5.0.7or above. - FortiSandbox PaaS
4.4, all versions: migrate to a fixed release.
The advisory marks FortiSandbox 5.2 and FortiSandbox PaaS 5.2 unaffected. Record the installed or assigned product, branch and specific version before scheduling a change; an appliance 4.4 fix and a PaaS 4.4 migration are different tasks. Fortinet credits Adham El Karn of its Product Security team with internal discovery and thanks Jason McFadyen of TrendAI Research for reporting the vulnerability.
Keep management access narrow
Restrict the FortiSandbox GUI at the firewall or access-control layer to the administration network and approved jump hosts. That is Nulltap’s network control for the remote-request path Fortinet describes. Compare the running version with the advisory’s table and move affected systems to the branch-specific fix; preserve any unusual GUI access and associated appliance activity for investigation before the upgrade erases useful context.
Verify both sides of the change: read back the installed release, then try an ordinary GUI connection from a trusted admin host and a separate untrusted segment. The admin route should work, and the untrusted route should be blocked by policy. This connection test checks the access boundary; the installed version check confirms the software remedy.