ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability
ZDI discloses an unauthenticated hard-coded credential bypass in Fortinet FortiSandbox, CVE-2026-107656 (CVSS 7.3).
58
Product
FortiSandbox
- Mentions · 7d0
- Mentions · 30d6
- All mentions11
- First seenSep 9, 2026
- Last mentioned15d ago
Timeline
11 articles · newest firstZDI-26-772: Fortinet FortiSandbox Admin Profile Improper Handling of Exceptional Conditions Denial-of-Service Vulnerability
ZDI disclosed a CVSS 4.9 authenticated denial-of-service flaw in Fortinet FortiSandbox admin profile handling.
28
Fortinet security advisory (AV26-1037)
Canada's Cyber Centre urges patches for file-write and SQL-injection flaws across several Fortinet products.
52
Improper access control and session management in the web management interface
Fortinet warns of a CVSS 9.6 unauthenticated authentication bypass in the FortiSandbox GUI.
74
Fabric API Authentication bypass
A hard-coded key in the FortiSandbox API lets unauthenticated attackers reach some endpoints.
44
Persistent Denial of Service in Admin Profile
A privileged attacker can persistently deny FortiSandbox GUI and CLI access, CVSS 4.8.
24
Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension
Fortinet patched 10 vulnerabilities including two critical authentication flaws, CVE-2026-84390 (CVSS 9.6) and CVE-2026-84388 (CVSS 9.1), in FortiMonitorOnSight and the FortiPAM Chrome extension.
58
Fortinet security advisory (AV26-898)
Canadian Cyber Centre advisory AV26-898 flags Fortinet vulnerabilities across FortiOS, FortiProxy, FortiPAM, FortiSandbox and FortiMonitorOnSight, urging administrators to apply updates
26
Fortinet FortiSandbox Vulnerability Allows Unauthenticated Attackers to Access Sensitive Information
Fortinet fixed CVE-2026-26084, an unauthenticated access-control flaw in FortiSandbox GUI rated 8.9 CVSS, with no known exploitation yet.
58
ZDI-26-645: Fortinet FortiSandbox write_remote_backup_to_crontab cronValue Command Injection Remote Code Execution Vulnerability
ZDI publishes ZDI-26-645 for CVE-2026-84387, an authenticated command injection RCE in Fortinet FortiSandbox via crontab backup, rated CVSS 7.2.
26
FortiSandbox Vulnerability Allows Attackers to Access Sensitive Information via Crafted HTTP Requests
Fortinet disclosed CVE-2026-26084 (CVSS 8.9), an unauthenticated information-disclosure flaw in the FortiSandbox web UI, urging upgrades.
48
Related CVEs
by mentions- CVE-2026-26084<1%9.9Improper Access Control in Fortinet FortiSandbox Exposes Sensitive Data
- Auth bypass to command execution in Fortinet FortiSandbox
- Sensitive Information in Source Code in Fortinet FortiMonitorOnSight (CVSS 9.8)
- CVE-2026-84388<1%9.6Unauthenticated UI-Layer Flaw in Fortinet FortiPAM Chrome Extension
- CVE-2026-84393<1%8.1Certificate Host-Mismatch Validation Flaw in FortiOS and FortiProxy ZTNA
- CVE-2026-84387<1%7.2High-Privilege Command Injection in Fortinet FortiSandbox
- Uncaught exception DoS in Fortinet FortiSandbox
Appears with
- Fortinetvendor · 11
- Fortinetorganization · 3
- FortiOSproduct · 2
- FortiSIEMproduct · 2
- FortiPAMproduct · 2
- Zero Day Initiativeorganization · 2
- FortiAnalyzerproduct · 2
- FortiMonitorOnSightproduct · 2
- FortiManagerproduct · 2
- Canadian Centre for Cyber Securityorganization · 2
- FortiProxyproduct · 2
- FortiMailproduct · 1
- Fortinet PSIRTorganization · 1
- FortiManager Cloudproduct · 1
- FortiAnalyzer Cloudproduct · 1
- FortiClientproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.