CVE-2026-107656

HIGH

This vulnerability allows remote attackers to bypass authentication on affected installations of Fortinet FortiSandbox. Authentication is not required to exploit this vulnerability. The ZDI has ass...

Affects 1 product across 1 vendor.

CVSS 3.x7.3
PatchUnknown
◆ AI Analysis — automated analysis, not human-reviewed

A high severity vulnerability (CVE-2026-107656) affects the target system. This vulnerability allows remote attackers to bypass authentication on affected installations of Fortinet FortiSandbox. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are as...

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-107656?
A high severity vulnerability (CVE-2026-107656) affects the target system. This vulnerability allows remote attackers to bypass authentication on affected installations of Fortinet FortiSandbox. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are as...
What is the CVSS score for CVE-2026-107656?
CVE-2026-107656 has CVSS 7.3 (High). Vector: None.
Is CVE-2026-107656 actively exploited?
No confirmed active exploitation of CVE-2026-107656 as of 2026-10-18.
How do I remediate CVE-2026-107656?
Apply vendor patches for CVE-2026-107656. Monitor Fortinet advisories.
What systems are affected by CVE-2026-107656?
CVE-2026-107656 affects Fortinet Fortinet FortiSandbox.
Vulnerability Details
CVE IDCVE-2026-107656
Published2026-10-15
Last Modified2026-10-15
ICS Relevance55%
SourceZDI
Official Description

This vulnerability allows remote attackers to bypass authentication on affected installations of Fortinet FortiSandbox. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-107656.

Source: NIST NVD / MITRE CVE Database

Affected Products
VendorProductAffected Versions
Fortinet Fortinet FortiSandbox —
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
Related CVEs affecting Fortinet
CVE-2005-3057 10.0 The FTP component in FortiGate 2.8 running FortiOS 2.8MR10 and v3beta, and ot... CVE-2026-26084 9.9 A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 throug... CVE-2020-9294 9.8 An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 an... CVE-2024-26011 9.8 A missing authentication for critical function in Fortinet FortiManager versi... CVE-2023-37936 9.8 A use of hard-coded cryptographic key in Fortinet FortiSwitch version 7.4.0 a...
View all Fortinet CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →