ZDI 2026-10-15

ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability

CVE-2026-107656

Machine-generated analysis · WAYSCloud LLM

Remote attackers can bypass authentication on FortiSandbox without credentials.

Context

The advisory concerns Fortinet FortiSandbox. It describes a hard-coded credential issue (login_user_profile) that enables authentication bypass. Exploitation does not require prior authentication. The CVSS score is 7.3 (CVE-2026-107656).

Operator considerations

Check: verify FortiSandbox version and presence of the login_user_profile component.
Isolate: consider segmenting or restricting network access to FortiSandbox until a fix is available.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to bypass authentication on affected installations of Fortinet FortiSandbox. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-107656.

Read the full advisory on ZDI →