CVE-2026-107656: FortiSandbox Improper access control and session management in the web management interface

3 karet z 3 položek · v celém archivu · celý přehled CZ · EN/orig

CVE-2026-107656

Pro tohle CVE zatím žádné hodnocení CVSS nemám. Buď ho záznam CVE Programu neuvádí, nebo ještě nebyl vydaný — advisories často citují rezervované ID dřív, než záznam vznikne.

cve.org · NVD

14. 10. 2026 16:31

NCSC-2026-0428 [1.00] [M/H] Kwetsbaarheden verholpen in Fortinet FortiSandbox

Fortinet heeft kwetsbaarheden verholpen in FortiSandbox. De kwetsbaarheid met kenmerk CVE-2026-107656 heeft een CVSS-score van 9,6 en betreft een authenticatieomzeiling in de webmanagementinterface van FortiSandbox. Een niet-geauthenticeerde kwaadwillende kan via speciaal vervaardigde HTTP-verzoeken de authenticatie omzeilen en ongeautoriseerd code of commando's uitvoeren. De kwetsbaarheden met kenmerk CVE-2026-106172 en CVE-2026-106170 zijn beide als middelmatig ingeschaald. CVE-2026-106172…

EPSS 0.00 CVE-2026-106170 CVE-2026-106172 CVE-2026-107656 Fortinet NL

tg: zranitelnost

14. 10. 2026 16:31 · NCSC-NL · NCSC-2026-0428 [1.00] [M/H] Kwetsbaarheden verholpen in Fortinet FortiSandbox

14. 10. 2026 12:19

Risolte vulnerabilità in prodotti Fortinet

Fortinet ha rilasciato aggiornamenti di sicurezza che sanano alcune vulnerabilità, di cui 2 con gravità "critica" e 2 con gravità "alta", in FortiSIEM, FortiMail, FortiSandbox, FortiAnalyzer e FortiManager. Tali vulnerabilità potrebbero consentire ad un attaccante remoto di eseguire codice o comandi non autorizzati, eludere i meccanismi di autenticazione, elevare i propri privilegi e scrivere/leggere file arbitrari sui sistemi interessati.

EPSS 0.00 CVE-2025-46773 CVE-2025-57739 CVE-2026-106173 CVE-2026-107656 Fortinet IT

tg: zranitelnost

14. 10. 2026 12:19 · CSIRT Itálie (ACN) · Risolte vulnerabilità in prodotti Fortinet

14. 10. 2026 · zachyceno 04:30

FortiSandbox Improper access control and session management in the web management interface

Classification: Critical, Solution: Official Fix, Exploit Maturity: Unproven, CVSSv3.1: 9.6, CVEs: CVE-2026-107656, Summary: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests.

CVSS 9.6 CVE-2026-107656 Fortinet FI

tg: zranitelnost tp: identita

14. 10. 2026 · zachyceno 04:30 · NCSC-FI · FortiSandbox Improper access control and session management in the web management interface