Fortinet published a batch of security advisories on October 13, 2026, and two of them are rated critical: an authentication bypass in the FortiSandbox web interface and a path traversal flaw in FortiSIEM, both reachable by an attacker with no credentials. Fortinet says none of the flaws in the batch is known to be exploited, but its gear is a frequent target, including a FortiMail zero-day exploited earlier this month, so the head start is worth using.
FortiSandbox's login can be bypassed
The most severe issue, CVE-2026-107656 (CVSSv3 9.6), is an authentication bypass using an alternate path or channel (CWE-288) in the FortiSandbox GUI. According to Fortinet's advisory FG-IR-26-185, a remote unauthenticated attacker could bypass authentication with crafted HTTP requests, and Fortinet lists the impact as execution of unauthorized code or commands. Adham El Karn of Fortinet's Product Security team found it internally, and Fortinet also thanks Jason McFadyen of TrendAI Research for reporting it.
FortiSandbox 5.0.0 through 5.0.6 is fixed in 5.0.7, and 4.4.0 through 4.4.9 in 4.4.10. FortiSandbox PaaS 5.0 also needs 5.0.7, while PaaS 4.4 has no fix and must migrate to a fixed release. Version 5.2 is not affected.
A second, lower-severity FortiSandbox bug, CVE-2026-106172 (CVSSv3 4.9), is a hard-coded cryptographic key in the FortiSandbox and FortiSandbox Cloud API that may let an unauthenticated attacker reach some endpoints (FG-IR-26-179). It was reported by Sina Kheirkhah (SinSinology) of watchTowr. This one does reach the 5.2 branch, with the fix due in the upcoming 5.2.2.
FortiSIEM 7.5.0 needs 7.5.1 or a port block
CVE-2026-106173 (CVSSv3 9.4) is a path traversal flaw (CWE-22) in FortiSIEM's grpc phQueryMaster component that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted packets, per FG-IR-26-180. Only FortiSIEM 7.5.0 is affected, and the fix is 7.5.1. If you cannot upgrade yet, Fortinet says restricting access to TCP port 27918 prevents the issue. FortiSIEM 7.6 and FortiSIEM Cloud are not affected. Gwendal Guégniaud of Fortinet's Product Security team found it.
The rest of the batch, by severity
- CVSS 7.9: SQL injection in FortiAnalyzer, FortiManager and their cloud versions that may let a low-privileged user execute arbitrary commands (CVE-2025-46773, CVE-2026-23705, CVE-2026-23706, CVE-2026-23707). The 7.2 on-premises branches get no fix and must migrate (FG-IR-26-178).
- CVSS 7.7: SQL injection in FortiMail webmail, exploitable by an authenticated attacker (CVE-2025-57739). Fortinet says FortiMail Cloud was already fixed in Q1 2026.
- CVSS 6.7: a denial of service against the FortiOS HTTPS management interface.
- CVSS 5.3: OS command injection in the FortiManager fgfmd daemon.
- CVSS 4.9: cross-site scripting in the FortiManager and FortiAnalyzer web UI.
- CVSS 4.8, 3.4 and 2.1: a persistent admin-profile denial of service in FortiSandbox, missing authorization in the FortiSIEM GUI, and a double free in the FortiOS, FortiProxy and FortiSwitch CLI.
Upgrade FortiSandbox and FortiSIEM first
Prioritize FortiSandbox 5.0.7 or 4.4.10 and FortiSIEM 7.5.1, since both critical flaws need no credentials. Teams on branches Fortinet will not fix, such as FortiSandbox PaaS 4.4 and on-premises FortiAnalyzer or FortiManager 7.2, should plan a migration rather than wait for a patch that is not coming.
FortiSandbox has been here before: earlier FortiSandbox flaws were exploited in June to hijack malware analysis servers. A box built to inspect hostile code is the last place a defender wants an intruder to get comfortable.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.