ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability
ZDI discloses an unauthenticated hard-coded credential bypass in Fortinet FortiSandbox, CVE-2026-107656 (CVSS 7.3).
Stories per day · 30 days
2 RSS
Relatedfortinet6authentication-bypass3psirt3denial-of-service2zdi2advisory1authenticated1cve-2026-1061701cve-2026-1076561cwe-2481cwe-2881cwe-3211fg-ir-26-1851fortianalyzer1fortimail1fortimanager1fortisiem1hardcoded-credentials1
10 stories, newest first · one card per story
Stories tagged #fortisandbox
Fortinet security advisory (AV26-1037)
Canada's Cyber Centre urges patches for file-write and SQL-injection flaws across several Fortinet products.
Improper access control and session management in the web management interface
Fortinet warns of a CVSS 9.6 unauthenticated authentication bypass in the FortiSandbox GUI.
Fabric API Authentication bypass
A hard-coded key in the FortiSandbox API lets unauthenticated attackers reach some endpoints.
Fortinet security advisory (AV26-898)
Canadian Cyber Centre advisory AV26-898 flags Fortinet vulnerabilities across FortiOS, FortiProxy, FortiPAM, FortiSandbox and FortiMonitorOnSight, urging administrators to apply updates
Fortinet FortiSandbox Vulnerability Allows Unauthenticated Attackers to Access Sensitive Information
Fortinet fixed CVE-2026-26084, an unauthenticated access-control flaw in FortiSandbox GUI rated 8.9 CVSS, with no known exploitation yet.
2
ZDI-26-645: Fortinet FortiSandbox write_remote_backup_to_crontab cronValue Command Injection Remote Code Execution Vulnerability
ZDI publishes ZDI-26-645 for CVE-2026-84387, an authenticated command injection RCE in Fortinet FortiSandbox via crontab backup, rated CVSS 7.2.
FortiSandbox Vulnerability Allows Attackers to Access Sensitive Information via Crafted HTTP Requests
Fortinet disclosed CVE-2026-26084 (CVSS 8.9), an unauthenticated information-disclosure flaw in the FortiSandbox web UI, urging upgrades.
2
Cron Job Injection in Remote Backup
Fortinet FortiSandbox command injection flaw (CVSS 6.7) in remote backup cron jobs lets privileged attackers execute arbitrary code via crafted HTTP requests.
Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information
Fortinet fixed an improper access control flaw (CVSS 8.9) in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS letting unauthenticated attackers access sensitive information.