{"id":"CVE-2026-107656","published":"2026-10-26T14:16:24Z","modified":"2026-10-27T04:17:40Z","title":"An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through…","vendor":"Fortinet","product":"FortiSandbox","tier":"core","eol":null,"description":{"text":"An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests","provenance":"source","from":"NVD"},"summary":{"text":"The authentication bypass in Fortinet FortiSandbox (affecting the 5.0.x, 4.4.x and 4.2 branches, and the corresponding PaaS releases) stems from an alternate path or channel that lets requests skip the normal authentication checks. An unauthenticated remote attacker who can reach the device over the network can send crafted HTTP requests to execute unauthorised code or commands, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:24:09Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00851,"percentile":0.58124,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":3,"pulses":[{"name":"Known_Cve | Oct 30, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6ae35d8e6ee9e838fd042498","created":"2026-10-29"},{"name":"Known_Cve | Oct 29, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ae20c290cecfbc79bd84822","created":"2026-10-28"},{"name":"Known_Cve | Oct 28, 2026 | Part 3/3","url":"https://otx.alienvault.com/pulse/6ae0ba957a5b2456c9113c92","created":"2026-10-27"}],"provenance":"machine"},"cwes":[{"id":"CWE-288","name":"Authentication Bypass Using an Alternate Path or Channel"}],"references":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-26-185","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-109831","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109831","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-26","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107656","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":19.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":11.62,"detail":"percentile 0.5812"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}