---
id: CVE-2026-107656
title: >-
  An authentication bypass using an alternate path or channel vulnerability in
  Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9,
  FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6,
  FortiSandbox …
summary: >-
  An authentication bypass using an alternate path or channel vulnerability in
  Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9,
  FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6,
  FortiSandbox …
severity: critical
cvss: 9.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-288
vendor: Fortinet
product: FortiSandbox
affected:
  - FortiSandbox >= 5.0.0 <= 5.0.6
  - FortiSandbox >= 4.4.0 <= 4.4.9
  - FortiSandbox >= 4.2.1 <= 4.2.8
  - fortisandbox_paas >= 5.0.0 <= 5.0.6
  - fortisandbox_paas >= 4.4.0 <= 4.4.9
  - fortisandbox_paas >= 4.2.1 <= 4.2.8
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-26T14:42:58.719453Z'
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T14:43:10.667Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107656'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-185'
    label: 'https://fortiguard.fortinet.com/psirt/FG-IR-26-185'
tags:
  - cve.org
ingestedAt: '2026-10-26T14:27:31.815Z'
---

## Overview

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests

## Affected

- `FortiSandbox >= 5.0.0 <= 5.0.6`
- `FortiSandbox >= 4.4.0 <= 4.4.9`
- `FortiSandbox >= 4.2.1 <= 4.2.8`
- `fortisandbox_paas >= 5.0.0 <= 5.0.6`
- `fortisandbox_paas >= 4.4.0 <= 4.4.9`
- `fortisandbox_paas >= 4.2.1 <= 4.2.8`

## Remediation

Upgrade to FortiSandbox version 5.2.0 or above
Upgrade to FortiSandbox version 5.0.7 or above
Upgrade to FortiSandbox version 4.4.10 or above
Upgrade to FortiSandbox PaaS version 5.0.7 or above