Fortinet FortiSandbox 5.0.0: authentication bypass

Fortinet FortiSandbox

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized…

Do this now

Upgrade FortiSandbox to 5.0.7 or 4.4.10, and FortiSandbox PaaS to 5.0.7, to fix the authentication bypass.

Fix it

FortiSandbox

On 4.xUpgrade to FortiSandbox 4.4.10
On 5.xUpgrade to FortiSandbox 5.0.7
On 4.xUpgrade to 4.4.10 or above (the CVE record's solution)

FortiSandbox PaaS

On 5.xUpgrade to FortiSandbox PaaS 5.0.7
On 4.xNo fix on 4.4.x: migrate to a fixed release
On 4.xUpgrade to 4.4.10 or above (the CVE record's solution)

First seen: 26 Oct 2026
Last update: 26 Oct 2026, 14:17 UTC
Fixed in: FortiSandbox 5.0.7
FortiSandbox 4.4.10
FortiSandbox PaaS 5.0.7
Identifiers: CVE-2026-107656
CVSS: 9.6
Source: news
On the menu as: VPN & firewalls

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Fortinet FortiSandbox 5.0.0: authentication bypass
Severity: critical. Patch status: patched.
Affected: Fortinet FortiSandbox
Fixed in: FortiSandbox 5.0.7, FortiSandbox 4.4.10, FortiSandbox PaaS 5.0.7
Ids: CVE-2026-107656

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized…

## Steps
1. This touches infrastructure (vpn-edge). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.
2. Fix by release line: FortiSandbox: 5.0.x → 5.0.7; 4.4.x → 4.4.10; 4.2.x → upgrade to 4.4.10 or above (the CVE record's solution). FortiSandbox PaaS: 5.0.x → 5.0.7; 4.4.x → no fix on 4.4.x: migrate to a fixed release; 4.2.x → upgrade to 4.4.10 or above (the CVE record's solution).

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| FortiSandbox 5.0.x | fixed | 5.0.7 | — |
| FortiSandbox 4.4.x | fixed | 4.4.10 | — |
| FortiSandbox 4.2.x | migrate | move to 4.4.10 | restrict network access to it |
| FortiSandbox PaaS 5.0.x | fixed | 5.0.7 | — |
| FortiSandbox PaaS 4.4.x | migrate | move to 5.0.7 | restrict network access to it |
| FortiSandbox PaaS 4.2.x | migrate | move to 4.4.10 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-107656") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://fortiguard.fortinet.com/psirt/FG-IR-26-185 https://nvd.nist.gov/vuln/detail/CVE-2026-107656
https://pwned.coffee/i/fortinet-fortisandbox-5-0-0-authentication-bypass-cve-2026-107656

Timeline

26 Oct 2026, 14:17 UTC
Fix status: unknown → patched.
26 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
FortiSandbox <= 5.0.6 5.0.7 Vendor advisory checked 26 Oct
FortiSandbox <= 4.4.9 4.4.10 Vendor advisory checked 26 Oct
FortiSandbox <= 4.2.8 upgrade to 4.4.10 or above (the CVE record's solution) CVE record (CNA) checked 26 Oct
FortiSandbox PaaS <= 5.0.6 5.0.7 Vendor advisory checked 26 Oct
FortiSandbox PaaS 4.4.0 to now no fix on 4.4.x: migrate to a fixed release Vendor advisory checked 26 Oct
FortiSandbox PaaS <= 4.2.8 upgrade to 4.4.10 or above (the CVE record's solution) CVE record (CNA) checked 26 Oct
Score: CVSS 9.6 (critical). CVSS 3.1 9.6 (CNA fortinet) for CVE-2026-107656
Last checked: 26 Oct 2026, 15:17 UTC

Product	Affected	Fixed in	Source
FortiSandbox	<= 5.0.6	5.0.7	Vendor advisory checked 26 Oct
FortiSandbox	<= 4.4.9	4.4.10	Vendor advisory checked 26 Oct
FortiSandbox	<= 4.2.8	upgrade to 4.4.10 or above (the CVE record's solution)	CVE record (CNA) checked 26 Oct
FortiSandbox PaaS	<= 5.0.6	5.0.7	Vendor advisory checked 26 Oct
FortiSandbox PaaS	4.4.0 to now	no fix on 4.4.x: migrate to a fixed release	Vendor advisory checked 26 Oct
FortiSandbox PaaS	<= 4.2.8	upgrade to 4.4.10 or above (the CVE record's solution)	CVE record (CNA) checked 26 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee