CVE-2026-107656

Status: ExternalCritical—⚠ Not verified by NVD — Fortinet PSIRT

Severity—Critical

Exploitation probability—next 30 days

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

Una vulnerabilidad de bypass de autenticación (CWE-288, uso de ruta o canal alternativo) en la GUI de FortiSandbox permite a un atacante remoto no autenticado eludir la autenticación mediante peticiones HTTP manipuladas. El aviso indica como impacto la ejecución de comandos o código no autorizados.

CVSS

NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).

Exploitation probability (EPSS)

FIRST hasn't scored this CVE yet (usual for very recent or rejected CVEs).

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Media coverage

Specialised security media that have cited this CVE:

Borns IT- und Windows-Blog · Fortinet patcht CVE-2026-107656 in FortiSandbox (10/15/2026)
NCSC-NL · NCSC-2026-0428 [1.00] [M/H] Kwetsbaarheden verholpen in Fortinet FortiSandbox (10/14/2026)
El Hacker · Vulnerabilidad crítica en FortiSandbox permite saltar autenticación (10/14/2026)
CISO Advisor · FortiSandbox tem falha crítica de bypass de autenticação (10/13/2026)

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Fortinet — Fortisandbox^AI

Raw JSON (NVD)

NVD hasn't published this CVE yet — all data on this page comes from the external advisory (Fortinet PSIRT). Once NVD publishes it, this page will update itself with the official data.