FortiSandbox Improper access control and session management in the web management interface
Classification: Critical, Solution: Official Fix, Exploit Maturity: Unproven, CVSSv3.1: 9.6, CVEs: CVE-2026-107656, Summary: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] in FortiSandbox GUI may allow a remote unauthenticated attacker to bypass authentication via crafted HTTP requests.
CVSS 9.6 CVE-2026-107656 Fortinet FI