ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability
Merged summary · from the lead articleSummaries by Vani AI
ZDI discloses an unauthenticated hard-coded credential bypass in Fortinet FortiSandbox, CVE-2026-107656 (CVSS 7.3).
Trend Micro's Zero Day Initiative published ZDI-26-771, an authentication-bypass flaw in Fortinet FortiSandbox involving hard-coded credentials in login_user_profile. Remote attackers can bypass authentication without valid credentials. ZDI assigned a CVSS score of 7.3 and CVE-2026-107656. The advisory does not state that the issue is being exploited.
Key facts
- Unauthenticated remote authentication bypass in Fortinet FortiSandbox
- Hard-coded credentials in the login_user_profile component
- ZDI rates the issue CVSS 7.3 and assigns CVE-2026-107656
- Advisory does not report observed exploitation
- Vendors
- Fortinet
- Products
- FortiSandbox
- Organizations
- Zero Day InitiativeFortinet
Coverage
oldest first · one row per article · UTC- · 15d ago
ZDI Published AdvisoriesFirst report
ZDI-26-772: Fortinet FortiSandbox Admin Profile Improper Handling of Exceptional Conditions Denial-of-Service Vulnerability
ZDI disclosed a CVSS 4.9 authenticated denial-of-service flaw in Fortinet FortiSandbox admin profile handling.
- · 15d ago
ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability
ZDI discloses an unauthenticated hard-coded credential bypass in Fortinet FortiSandbox, CVE-2026-107656 (CVSS 7.3).
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-106170 | Uncaught exception DoS in Fortinet FortiSandbox | 4.9 | — | ||
| CVE-2026-107656 | Auth bypass to command execution in Fortinet FortiSandbox | 9.8 | — |