Fortinet and ZDI detail FortiSandbox and FortiOS flaws

Fortinet revised three advisories; ZDI later assigned two FortiSandbox CVEs with different scores, and none report exploitation.

Fortinet revised three PSIRT advisories on 2026-10-13, none of which names a CVE or says exploitation has been observed. FG-IR-26-185 describes a CVSS 9.6 authentication bypass (CWE-288) in the FortiSandbox web management interface that may let a remote unauthenticated attacker bypass authentication with crafted HTTP requests. FG-IR-26-181 describes a CVSS 6.7 improper-locking flaw (CWE-667) in FortiOS that an unauthenticated attacker can use to deny service to the HTTPS management interface. FG-IR-26-176 describes a CVSS 4.8 uncaught exception (CWE-248) in FortiSandbox Admin Profile that a privileged attacker can use to persistently deny GUI and CLI access. On 2026-10-15, ZDI published ZDI-26-771, an unauthenticated hard-coded-credential bypass in FortiSandbox login_user_profile scored CVSS 7.3 and tracked as CVE-2026-107656, and ZDI-26-772, an authenticated admin-profile denial of service from improper handling of exceptional conditions scored CVSS 4.9 and tracked as CVE-2026-106170; neither reports exploitation. The reports disagree on severity and weakness class for the FortiSandbox authentication-bypass and admin-profile issues, and they do not explicitly state that the ZDI CVEs correspond to FG-IR-26-185 or FG-IR-26-176.

• Fortinet FG-IR-26-185, revised 2026-10-13: FortiSandbox web-management authentication bypass (CWE-288), CVSS 9.6; a remote unauthenticated attacker may bypass authentication with crafted HTTP requests. No CVE or exploitation is stated.
• Fortinet FG-IR-26-181, revised 2026-10-13: FortiOS improper locking (CWE-667), CVSS 6.7; an unauthenticated attacker with network access can deny service to the HTTPS management interface with crafted HTTP requests. No CVE or exploitation…
• Fortinet FG-IR-26-176, revised 2026-10-13: FortiSandbox Admin Profile uncaught exception (CWE-248), CVSS 4.8; a privileged attacker can persistently deny GUI and CLI access with crafted HTTP requests. No CVE or exploitation is stated.
• ZDI-26-771, published 2026-10-15: unauthenticated remote authentication bypass via hard-coded credentials in FortiSandbox login_user_profile, CVE-2026-107656, CVSS 7.3. Exploitation is not reported.
• ZDI-26-772, published 2026-10-15: authenticated denial of service from improper handling of exceptional conditions in a FortiSandbox admin profile, CVE-2026-106170, CVSS 4.9. Exploitation is not reported.
• Sources disagree on the FortiSandbox authentication-bypass issue (Fortinet CVSS 9.6, CWE-288, no CVE versus ZDI CVSS 7.3, hard-coded credentials, CVE-2026-107656) and the admin-profile issue (Fortinet CVSS 4.8, CWE-248, persistent GUI and…