CVE-2026-107656

🚨 FORTINET OCT 13: CRITICAL FORTISANDBOX AUTH BYPASS (CVSS 9.6) + FORTISIEM UNAUTH RCE (CVSS 9.4) Fortinet’s Product Security team published critical advisories on Oct 13, 2026 as part of its October PSIRT batch. • CVE-2026-107656 (FG-IR-26-185) — FortiSandbox GUI authentication bypass via alternate path (CWE-288), CVSS 9.6. Remote unauthenticated attacker can gain unauthorized access through crafted HTTP requests. • Affected: FortiSandbox / PaaS 5.0.0–5.0.6 → upgrade to 5.0.7+; 4.4.0–4.4.9 → 4.4.10+ (4.4 PaaS: migrate). FortiSandbox 5.2 not affected. • CVE-2026-106173 (FG-IR-26-180) — FortiSIEM path traversal enabling unauthenticated code execution, CVSS 9.4. Affects FortiSIEM 7.5.0 only → upgrade to 7.5.1+ (or restrict TCP 27918). FortiSIEM 7.6 and FortiSIEM Cloud not affected. • Fortinet states no known exploitation for either critical at publication. • Same day batch also covers High/Medium issues in FortiAnalyzer, FortiManager, FortiMail, and FortiOS. ⚠️ Analyst Note: Official Fortinet PSIRT advisories (not a dark-web claim). Prioritize patching internet-reachable FortiSandbox management UIs and FortiSIEM collectors exposing the phQueryMaster port. Primary: https://www.fortiguard.com/psirt/FG-IR-26-185 Also: https://fortiguard.fortinet.com/psirt/FG-IR-26-180 #DDW #DarkWeb #Fortinet #FortiSandbox #FortiSIEM #CVE #ThreatIntelligence #CyberSecurity

‼️ Fortinet patched a critical FortiSandbox flaw that lets a remote attacker skip the login and run commands. CVE-2026-107656, rated 9.6, needs only crafted HTTP requests. Versions 5.0.0 to 5.0.6 and 4.4.0 to 4.4.9 are affected. https://t.co/gF3KTYA1Z1

CVE advisory: CVE-2026-107656 - fortinet: Improper access control and session management in the web management interface. https://vulnipulse.com/advisories/fortinet-fg-ir-26-185 #CVE #CyberSecurity #Fortinet #FortiSandbox

#NØØT_Security_Alerts 🚨 #ALERT — FORTINET FORTISANDBOX: CRITICAL UNAUTHENTICATED GUI BYPASS THREATENS SECURITY APPLIANCES October 13, 2026 DISCLOSED BY: Fortinet PSIRT PRODUCT: Fortinet FortiSandbox / FortiSandbox PaaS CVE: CVE-2026-107656 SEVERITY: CRITICAL — CVSS 9.6 WEAKNESS: CWE-288 — Authentication Bypass Using an Alternate Path or Channel AFFECTED VERSIONS: FortiSandbox 5.0.0–5.0.6. FortiSandbox 4.4.0–4.4.9. FortiSandbox PaaS 5.0.0–5.0.6. FortiSandbox PaaS 4.4 — all versions. FortiSandbox 5.2 and FortiSandbox PaaS 5.2 are not affected. IMPACT: Improper access control and session management in the web management interface could allow remote attackers to bypass authentication using specially crafted HTTP requests. Successful exploitation could provide unauthorized access to protected appliance functionality. Fortinet identifies potential unauthorized code or command execution as an impact. The precise exploit chain has not been publicly established. EXPOSURE: Requires network access to the vulnerable management interface. The CVSS assessment specifies low attack complexity, no authentication requirement and no user interaction. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL AUTHENTICATION BYPASS. Fortinet reports no known exploitation in the wild. No independently verified public working exploit has been established. This vulnerability must not be confused with previously exploited FortiSandbox vulnerabilities affecting different components. Forensic triage: Investigate unexpected management-interface requests, abnormal administrative activity, suspicious configuration changes and unexplained appliance processes. Review available HTTP access logs and management authentication records. No verified CVE-specific malicious IOCs or exploit signatures have been published. URGENT ACTION: Upgrade affected deployments: FortiSandbox 5.0 → 5.0.7 or later. FortiSandbox 4.4 → 4.4.10 or later. FortiSandbox PaaS 5.0 → 5.0.7 or later. Migrate FortiSandbox PaaS 4.4 installations to a fixed release. Restrict management-interface access to trusted administrative networks. Verify installed versions and investigate suspicious historical activity. SOURCE: https://fortiguard.fortinet.com/psirt/FG-IR-26-185 CONFIDENCE: HIGH — Fortinet PSIRT advisory FG-IR-26-185 identifies the authentication bypass, affected versions, severity and remediation requirements. UNVERIFIED — Active exploitation, attacker attribution and actual compromise. #CyberSecurity #ThreatIntel #Fortinet #FortiSandbox #AuthBypass #NetworkSecurity

الي يستخدم FortiSandbox لازم ينتبه.. ثغرة خطيرة في الواجهة (GUI) تسمح للمهاجمين يتخطون تسجيل الدخول عن بعد ويدخلون على وظائف محمية بدون بيانات دخول صحيحة. 😱 مسجلة باسم CVE-2026-107656، وتقييمها CVSSv3 يوصل 9.6، يعني من أشد الثغرات، وتأثر على أجهزة FortiSandbox وعلى بعض إصدارات FortiSandbox PaaS. Fortinet تقول إن التأثير المحتمل هو تنفيذ كود أو أوامر بدون تصريح، بس الاستغلال المعروف مكتوب عندهم "No"، يعني ما فيه دليل إن المهاجمين استخدموها فعليًا في هجمات حقيقية لين الحين.

🩹マイクロソフト、2026年10月の月例パッチで1,411件の脆弱性を修正：CVE-2026-96951他 ⚠️Fortinet、FortiSandboxにおけるCriticalな脆弱性について警告：CVE-2026-107656 🚨WordPressプラグインBricksforgeの脆弱性、悪用試行が確認される：CVE-2026-85097 〜サイバーアラート10月14日〜 https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/48072/

Urgent alert for network security teams: FortiSandbox GUI’s authentication can be bypassed remotely via HTTP, affecting versions 4.4.x and 5.0.x. CVE-2026-107656 scores 9.6, letting attackers issue unauthorized commands without credentials. If you're running affected versions, upgrade to 4.4.10 or 5.0.7 now. Monitor unusual HTTP requests targeting your GUI and confirm whether your PaaS deployment is at risk. #Security #Fortinet #Vulnerability #AuthBypass #Fortinet #Cybersecurity #AuthBypass #CVE2026 #NetworkSecurity #Vulnerability https://thedailytechfeed.com/critical-fortisandbox-bug-lets-remote-attackers-skip-login-screens/