Fabric API Authentication bypass
A hard-coded key in the FortiSandbox API lets unauthenticated attackers reach some endpoints.
Fortinet PSIRT FG-IR-26-179 reports use of a hard-coded cryptographic key (CWE-321) in the FortiSandbox and FortiSandbox Cloud API. An unauthenticated attacker can access some endpoints with specially crafted HTTP requests. Fortinet scores the issue CVSS 4.9. The advisory was revised on 2026-10-13 and mentions neither a CVE nor observed exploitation.
- CVSS 4.9 hard-coded cryptographic key (CWE-321) in FortiSandbox API
- Unauthenticated attackers can reach some endpoints with crafted HTTP requests
- Affects FortiSandbox and FortiSandbox Cloud
- No CVE or active exploitation is stated
CVSSv3 Score: 4.9 A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and FortiSandbox Cloud API may allow an unauthenticated attacker to access some endpoints via specially crafted HTTP requests Revised on 2026-10-13 00:00:00
This source does not provide full text. Read it at fortiguard.fortinet.com.