FortiSandbox CVE-2026-107656

Exploitation targets the FortiSandbox HTTP interface: an attacker sends crafted HTTP requests that abuse an alternate path or channel to bypass authentication (CWE-288), then executes unauthorized code or commands. Per the CVSS vector (PR:N/UI:N), no authentication and no user interaction are required, implying exploitability against default/standard configurations reachable over the network. The available sources do NOT describe a specific feature toggle or non-default configuration prerequisite, nor the exact mechanism of the alternate-channel bypass. The primary limiting factor is network reachability to the FortiSandbox or FortiSandbox PaaS management/HTTP service - appliances whose management interface is not exposed to untrusted networks present a reduced attack surface. Affected deployments include on-premises FortiSandbox 5.0.0-5.0.6, 4.4.0-4.4.9, 4.2 (all), and FortiSandbox PaaS 5.0.0-5.0.6, 4.4 (all), 4.2 (all).

This is a genuine high-priority issue, not a high-CVSS/low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) describes a remote, unauthenticated, low-complexity authentication bypass (CWE-288, alternate path/channel) leading to unauthorized code or command execution - the most dangerous combination of metrics. The vuln.today decision label is 'act_now', and the issue was reported by Fortinet itself via PSIRT advisory FG-IR-26-185, which corroborates the severity signal. Several signals that would normally sharpen prioritization are MISSING from the input: no EPSS exploitation-probability score is provided, there is no CISA KEV listing, and no proof-of-concept or exploit reference is present. Therefore, despite the maximal CVSS and 'act_now' label, there is no evidence of active exploitation or public exploit code at this time - the urgency rests on the intrinsic severity of an unauthenticated auth-bypass-to-code-execution flaw in a security appliance, not on observed in-the-wild activity. Treat it as an urgent patch given the attack surface, while noting the exploitation-likelihood data is absent rather than confirmed.

A remote attacker with network reachability to the FortiSandbox management/HTTP interface sends specially crafted HTTP requests that exploit the alternate-path authentication bypass, gaining access without valid credentials. Because the flaw permits execution of unauthorized code or commands, the attacker can then run commands on the appliance. No public proof-of-concept or exploit code is identified in the available data, and the precise request structure is not described in the sources.