Improper access control and session management in the web management interface
Fortinet warns of a CVSS 9.6 unauthenticated authentication bypass in the FortiSandbox GUI.
Fortinet PSIRT advisory FG-IR-26-185 describes an authentication-bypass flaw in the FortiSandbox web management interface, scored CVSS 9.6. Classified as CWE-288, Authentication Bypass Using an Alternate Path or Channel, it may let a remote unauthenticated attacker bypass authentication with crafted HTTP requests. The bulletin was revised on 2026-10-13 and does not name a CVE or say exploitation has been observed.
- FortiSandbox GUI flaw is rated CVSS 9.6.
- CWE-288: authentication bypass via an alternate path.
- Remote unauthenticated attackers can use crafted HTTP requests.
- Fortinet advisory FG-IR-26-185; no CVE or exploitation stated.
CVSSv3 Score: 9.6 An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests. Revised on 2026-10-13 00:00:00
This source does not provide full text. Read it at fortiguard.fortinet.com.