1-minute read
What a defender needs to know
Fortinet’s October 13 advisory rates CVE-2026-107656 Critical: crafted HTTP requests to the FortiSandbox GUI may bypass authentication. Fortinet lists unauthorized code or command execution as the impact and marks known exploitation No. This affects management access to a sandbox appliance or its PaaS service, so start with the release inventory and the networks that can reach the GUI.
For FortiSandbox appliances, upgrade 5.0.0–5.0.6 to 5.0.7 or above and 4.4.0–4.4.9 to 4.4.10 or above. For FortiSandbox PaaS, upgrade 5.0.0–5.0.6 to 5.0.7 or above; migrate every PaaS 4.4 release to a fixed release. Fortinet marks appliance and PaaS 5.2 unaffected. The vendor lists no virtual patch.
Restrict the GUI to your administration network and approved jump hosts. Review GUI access records for unexpected sources, correlate those connections with appliance activity and network logs, and preserve suspicious records. The advisory provides no HTTP exploit indicator; corroborate unusual GUI connections with appliance and network activity before treating them as suspected exploitation. After upgrading, read back the running release and try normal GUI connections from an approved admin host and an untrusted segment: the first should connect, the second should be denied by policy.