Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN1016
_____________________________________________________________________

DATE                : 14/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running FortiSandbox versions prior to
                                     5.0.7, 5.2.2,
                 FortiSandbox Cloud versions prior to 5.0.7, 5.2.2.

====================================================================
https://fortiguard.fortinet.com/psirt/FG-IR-26-185
https://fortiguard.fortinet.com/psirt/FG-IR-26-179
https://fortiguard.fortinet.com/psirt/FG-IR-26-176
_____________________________________________________________________

Improper access control and session management in the web management
interface


Summary

An Authentication Bypass Using an Alternate Path or Channel
vulnerability [CWE-288] in FortiSandbox GUI may allow a remote
unauthenticated attacker to bypass authentication via crafted
HTTP requests.


Version         Affected         Solution

FortiSandbox 5.2         Not affected         Not Applicable

FortiSandbox 5.0         5.0.0 through 5.0.6         Upgrade to
5.0.7 or above

FortiSandbox 4.4         4.4.0 through 4.4.9         Upgrade to
4.4.10 or above

FortiSandbox PaaS 5.2         Not affected         Not Applicable

FortiSandbox PaaS 5.0         5.0.0 through 5.0.6         Upgrade to
5.0.7 or above

FortiSandbox PaaS 4.4         4.4 all versions         Migrate to
a fixed release


Acknowledgement

Internally discovered and reported by Adham El Karn of Fortinet Product
Security team. Fortinet is also pleased to thank Jason McFadyen of
TrendAI Research for reporting this vulnerability under responsible
disclosure.


Virtual Patch
No


Timeline

2026-10-13: Initial publication


IR Number         FG-IR-26-185
Published Date         Oct 13, 2026
Component         GUI
Severity         Critical
Discovered         Internal
Attack Type         Unauthenticated
Known Exploited         No
CVSSv3 Score         9.6
Impact          Execute unauthorized code or commands
CVE ID          CVE-2026-107656

Download         

CVRF

CSAF

_____________________________________________________________________

Fabric API Authentication bypass
Summary

A Use of Hard-coded Cryptographic Key [CWE-321] in FortiSandbox and
FortiSandbox Cloud API may allow an unauthenticated attacker to
access some endpoints via specially crafted HTTP requests


Version         Affected         Solution

FortiSandbox 5.2         5.2.0 through 5.2.1         Upgrade to upcoming
5.2.2 or above

FortiSandbox 5.0         5.0.0 through 5.0.6         Upgrade to 5.0.7 or
above

FortiSandbox 4.4         4.4 all versions         Migrate to a fixed
release

FortiSandbox Cloud 5.2         5.2.0 through 5.2.1         Upgrade to upcoming
5.2.2 or above

FortiSandbox Cloud 5.0         5.0.0 through 5.0.6         Upgrade to upcoming
5.0.7 or above

FortiSandbox Cloud 4.4         4.4 all versions         Migrate to a fixed
release


Acknowledgement

Fortinet is pleased to thankSina Kheirkhah (SinSinology) of watchTowr
(watchTowrCyber) for reporting this vulnerability under responsible
disclosure.


Virtual Patch
No

Timeline

2026-10-13: Initial publication

IR Number         FG-IR-26-179
Published Date         Oct 13, 2026
Component         API
Severity         Medium
Discovered         External
Attack Type         Unauthenticated
Known Exploited         No
CVSSv3 Score         4.9
Impact          Escalation of privilege
CVE ID          CVE-2026-106172

Download         

CVRF

CSAF


_____________________________________________________________________

Persistent Denial of Service in Admin Profile

Summary

An Uncaught Exception vulnerability [CWE-248] in FortiSandbox may
allow a privileged attacker to deny access to the GUI and CLI
persistently via crafted HTTP requests.


Version         Affected         Solution

FortiSandbox 5.2         5.2.0 through 5.2.1         Upgrade to 5.2.2 or
above

FortiSandbox 5.0         5.0.0 through 5.0.6         Upgrade to 5.0.7 or
above

FortiSandbox 4.4         4.4 all versions         Migrate to a fixed
release


Acknowledgement
Fortinet is pleased to thank Jason McFadyen of TrendAI Research for
reporting this vulnerability under responsible disclosure.


Virtual Patch
No

Timeline

2026-10-13: Initial publication


IR Number         FG-IR-26-176
Published Date         Oct 13, 2026
Component         GUI
Severity         Medium
Discovered         External
Attack Type         Authenticated
Known Exploited         No
CVSSv3 Score         4.8
Impact          Denial of service
CVE ID          CVE-2026-106170

Download         

CVRF

CSAF

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================