Fortinet FortiSandbox GUI authentication bypass (CVE-2026-107656, CVSS 9.6) and FortiSIEM 7.5.0 unauthenticated path traversal to code execution (CVE-2026-106173, CVSS 9.4): both critical, fixed 2026-10-13, neither reported exploited
FortiSandbox GUI auth bypass (9.6) and FortiSIEM 7.5.0 pre-auth code execution (9.4) fixed; no exploitation listed
Defender actions
- Check every FortiSandbox that was upgraded to 5.0.6 or 4.4.9 after the exploited-flaw advisories of this year: those builds are still affected by CVE-2026-107656 and need 5.0.7 or 4.4.10; on FortiSIEM 7.5.0 install 7.5.1, or until then restrict access to tcp 27918 as Fortinet's workaround says.
Analysis
Fortinet's PSIRT published two critical advisories for security-operations products on 2026-10-13. FG-IR-26-185 describes an authentication bypass through an alternate path or channel in the FortiSandbox GUI that a remote unauthenticated attacker can trigger with crafted HTTP requests, listed as CVE-2026-107656 with CVSS 3.1 9.6 and an impact of unauthorized code or command execution (Fortinet PSIRT FG-IR-26-185, 2026-10-13). FG-IR-26-180 describes a path traversal in the FortiSIEM phQueryMaster service ("arbitrary file write in grpc phQueryMaster") that lets an unauthenticated attacker execute unauthorized code or commands through specially crafted packets, listed as CVE-2026-106173 with CVSS 3.1 9.4 (Fortinet PSIRT FG-IR-26-180, 2026-10-13). Both pages state that neither flaw is known to be exploited, and both carry temporal vector strings with an exploit-code maturity of functional (FortiSandbox) and high (FortiSIEM) that the advisories do not explain (Fortinet PSIRT FG-IR-26-185, 2026-10-13; Fortinet PSIRT FG-IR-26-180, 2026-10-13).
For FortiSandbox, versions 5.0.0 through 5.0.6 and 4.4.0 through 4.4.9 are affected and 5.0.7 and 4.4.10 fix it; 5.2 is not affected; FortiSandbox PaaS 5.0.0 through 5.0.6 is affected, and every PaaS 4.4 version must migrate to a fixed release (Fortinet PSIRT FG-IR-26-185, 2026-10-13). The ranges include 5.0.6 and 4.4.9 (Fortinet PSIRT FG-IR-26-185, 2026-10-13). Defused reported exploitation of three FortiSandbox flaws in June, CVE-2026-39813, CVE-2026-39808 and CVE-2026-25089 (Help Net Security, 2026-06-16), and the build that fixes CVE-2026-25089 is 5.0.6 on the 5.0 branch and 4.4.9 on 4.4 (Fortinet PSIRT FG-IR-26-141, 2026-06-09), so a unit patched for that flaw is not patched for this one. For FortiSIEM only 7.5.0 is affected and 7.5.1 fixes it; 7.6 and FortiSIEM Cloud are not affected, and Fortinet's workaround is to restrict access on tcp port 27918 (Fortinet PSIRT FG-IR-26-180, 2026-10-13).
Cited evidence
may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests
may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets
Restricting access on tcp port 27918 prevents the issue.
Sources4
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.