T
Threats
Fortinet Authentication Bypass and Injection Vulnerabilities
Overview
Vendor: Fortinet
Overall severity: Critical, highest vendor-published CVSSv3 score 9.6
Advisory date: 14 October 2026
Vendor publication: 13 October 2026. The reviewed advisories list initial publication on that date, with no later revision listed.
CVEs, in vendor-severity order: CVE-2026-107656, CVE-2026-106173, CVE-2025-46773, CVE-2025-57739, CVE-2026-23705, CVE-2026-23707, CVE-2026-23706, CVE-2026-106171, CVE-2026-106172, CVE-2026-106170.
Prioritise the two unauthenticated critical vulnerabilities, then remediate the remaining affected products using the version-specific guidance below. Fortinet marks known exploitation as No in all seven reviewed advisories. This is the vendor's reported status, not a guarantee that exploitation cannot occur.
Scoring note: This report follows Fortinet's published severity ratings. Its per-CVE FG-IR-26-178 CSAF data gives scores of 7.9, 6.5, 5.9 and 6.5 for the four SQL injection CVEs respectively. Those vectors include temporal metrics. NVD separately displays Fortinet CNA base scores of 8.8, 7.2, 6.5 and 7.2. These are not interchangeable score types. Fortinet rates FortiSIEM at 9.4, rather than the 9.8 displayed by the supplied StackFlag listing. Vendor ratings determine the ordering below.
Affected Versions
Version statements and exceptions apply only to the CVEs named in each entry. A branch unaffected by one advisory can still be affected by another.
Critical: FortiSandbox GUI authentication bypass
Applies to CVE-2026-107656.
FortiSandbox
Affected: 5.0.0 through 5.0.6; 4.4.0 through 4.4.9.
Fixed: 5.0.7 or later in the 5.0 branch; 4.4.10 or later in the 4.4 branch.
Not affected: 5.2 branch.
Source: Fortinet FG-IR-26-185, FortiSandbox GUI authentication bypass.
FortiSandbox PaaS
Affected: 5.0.0 through 5.0.6; all 4.4 versions.
Fixed: 5.0.7 or later in the 5.0 branch. For 4.4, migrate to a fixed release; no in-branch fix is listed.
Not affected: 5.2 branch.
Source: Fortinet FG-IR-26-185, FortiSandbox PaaS affected versions and solutions.
Critical: FortiSIEM path traversal
Applies to CVE-2026-106173.
Affected: FortiSIEM 7.5.0.
Fixed: FortiSIEM 7.5.1 or later in the 7.5 branch.
Not affected: FortiSIEM 7.6 branch and FortiSIEM Cloud.
High and Medium: FortiAnalyzer and FortiManager SQL injection
The product-to-CVE mapping below follows Fortinet's per-CVE CSAF records. The shared advisory supplies the same affected and fixed ranges for each listed product's relevant CVEs.
FortiAnalyzer
Applies to CVE-2025-46773, CVE-2026-23705, CVE-2026-23707 and CVE-2026-23706.
Affected: 7.6.0 through 7.6.4; 7.4.0 through 7.4.7; all 7.2 versions.
Fixed: 7.6.5 or later in the 7.6 branch; 7.4.8 or later in the 7.4 branch. For 7.2, migrate to a fixed release; no in-branch fix is listed.
Not affected: 8.0 branch for these SQL injection CVEs.
Source: Fortinet FG-IR-26-178, FortiAnalyzer version guidance and per-CVE CSAF records.
FortiAnalyzer Cloud
Applies to CVE-2025-46773, CVE-2026-23707 and CVE-2026-23706.
Affected: 7.6.2 through 7.6.4; 7.4.1 through 7.4.7; 7.2.1 through 7.2.11.
Fixed: 7.6.5 or later in the 7.6 branch; 7.4.8 or later in the 7.4 branch; 7.2.12 or later in the 7.2 branch.
Source: Fortinet FG-IR-26-178, FortiAnalyzer Cloud version guidance and per-CVE CSAF records.
FortiManager
Applies to CVE-2026-23705, CVE-2026-23707 and CVE-2026-23706.
Affected: 7.6.0 through 7.6.4; 7.4.0 through 7.4.6; all 7.2 versions.
Fixed: 7.6.5 or later in the 7.6 branch; 7.4.7 or later in the 7.4 branch. For 7.2, migrate to a fixed release; no in-branch fix is listed.
Not affected: 8.0 branch for these SQL injection CVEs. FortiManager 8.0.0 is separately affected by the command injection issue below.
Source: Fortinet FG-IR-26-178, FortiManager SQL injection version guidance and per-CVE CSAF records.
FortiManager Cloud
Applies to CVE-2026-23707.
Affected: 7.6.2 through 7.6.4.
Fixed: 7.6.5 or later in the 7.6 branch.
Not affected: 8.0, 7.4 and 7.2 branches for this SQL injection CVE.
Source: Fortinet FG-IR-26-178, FortiManager Cloud version guidance and per-CVE CSAF records.
High: FortiMail webmail SQL injection
Applies to CVE-2025-57739.
FortiMail
Affected: 7.6.0 through 7.6.3; 7.4.0 through 7.4.5; 7.2.0 through 7.2.8.
Fixed: 7.6.4 or later in the 7.6 branch; 7.4.6 or later in the 7.4 branch; 7.2.9 or later in the 7.2 branch.
Not affected: 8.0 branch.
Source: Fortinet FG-IR-26-184, FortiMail webmail SQL injection.
FortiMail Cloud
Affected: The vendor has not specified an exact affected-version range as of 13 October 2026.
Fixed: Fortinet states that FortiMail Cloud was remediated in Q1 2026. It does not identify a fixed build and says customers need not perform any action.
Source: Fortinet FG-IR-26-184, FortiMail Cloud remediation statement.
Medium: FortiManager OS command injection
Applies to CVE-2026-106171.
FortiManager
Affected: 8.0.0; 7.6.0 through 7.6.6.
Fixed: 8.0.1 or later in the 8.0 branch; 7.6.7 or later in the 7.6 branch.
Not affected: 7.4 and 7.2 branches for this command injection CVE.
Source: Fortinet FG-IR-26-177, FortiManager fgfmd command injection.
FortiManager Cloud
Affected: 7.6.2 through 7.6.6.
Fixed: 7.6.7 or later in the 7.6 branch.
Not affected: 8.0, 7.4 and 7.2 branches for this command injection CVE.
Source: Fortinet FG-IR-26-177, FortiManager Cloud version guidance.
Medium: FortiSandbox API hard-coded cryptographic key
Applies to CVE-2026-106172.
FortiSandbox
Affected: 5.2.0 through 5.2.1; 5.0.0 through 5.0.6; all 4.4 versions.
Fixed: 5.2.2 or later in the 5.2 branch, listed as upcoming; 5.0.7 or later in the 5.0 branch. For 4.4, migrate to a fixed release; no in-branch fix is listed.
Source: Fortinet FG-IR-26-179, FortiSandbox API affected versions and solutions.
FortiSandbox Cloud
Affected: 5.2.0 through 5.2.1; 5.0.0 through 5.0.6; all 4.4 versions.
Fixed: 5.2.2 or later in the 5.2 branch and 5.0.7 or later in the 5.0 branch, both listed as upcoming. For 4.4, migrate to a fixed release; no in-branch fix is listed.
Source: Fortinet FG-IR-26-179, FortiSandbox Cloud affected versions and solutions.
Do not treat a release described as upcoming as already available. Confirm availability and the applicable remediation path with Fortinet.
Medium: FortiSandbox persistent denial of service
Applies to CVE-2026-106170.
Affected: FortiSandbox 5.2.0 through 5.2.1; 5.0.0 through 5.0.6; all 4.4 versions.
Fixed: 5.2.2 or later in the 5.2 branch; 5.0.7 or later in the 5.0 branch. For 4.4, migrate to a fixed release; no in-branch fix is listed.
Source: Fortinet FG-IR-26-176, FortiSandbox persistent denial of service.
The denial-of-service bulletin lists 5.2.2 without an upcoming qualifier. The API bulletin above still calls that release upcoming. Confirm availability before scheduling the upgrade.
Vulnerability Breakdown
CVE-2026-107656 - FortiSandbox GUI authentication bypass
Severity: Critical.
Vendor-published CVSSv3: 9.6.
Description: An alternate-path or channel authentication bypass, CWE-288, affects the FortiSandbox GUI and specified FortiSandbox PaaS releases. Crafted HTTP requests may bypass authentication.
Impact: Unauthorised access; Fortinet lists potential execution of unauthorised code or commands.
Conditions: Remote access to the vulnerable GUI. No authentication is required.
CVE-2026-106173 - FortiSIEM path traversal
Severity: Critical.
Vendor-published CVSSv3: 9.4.
Description: Improper pathname restriction, CWE-22, in FortiSIEM 7.5.0 may be exploited using specially crafted packets.
Impact: Execution of unauthorised code or commands.
Conditions: Unauthenticated network access to the affected service. Fortinet identifies TCP port 27918 in its workaround.
Notes: FortiSIEM Cloud is not affected. Use Fortinet's 9.4 rating rather than the supplied third-party 9.8 listing.
CVE-2025-46773 - FortiAnalyzer SQL injection
Severity: High, following Fortinet's per-CVE CSAF rating.
Vendor-published CVSSv3: 7.9. NVD separately displays a CNA base score of 8.8, High.
Description: SQL injection, CWE-89, affects FortiAnalyzer and FortiAnalyzer Cloud. Crafted requests may allow arbitrary-command execution under the shared vendor advisory.
Impact: Unauthorised code or command execution, with confidentiality, integrity and availability impact in the CVSS vector.
Conditions: Authenticated access with low privileges, PR:L in the vendor vector.
CVE-2025-57739 - FortiMail webmail SQL injection
Severity: High.
Vendor-published CVSSv3: 7.7.
Description: SQL injection, CWE-89, in FortiMail webmail may be triggered through specially crafted HTTP requests.
Impact: Execution of unauthorised code or commands; Fortinet categorises the impact as privilege escalation.
Conditions: The attacker must be authenticated.
Notes: Fortinet has already remediated FortiMail Cloud and says no customer action is required there.
CVE-2026-23705 - FortiAnalyzer and FortiManager SQL injection
Severity: Medium, following Fortinet's per-CVE CSAF rating.
Vendor-published CVSSv3: 6.5. NVD separately displays a CNA base score of 7.2, High.
Description: SQL injection, CWE-89, affects FortiAnalyzer and FortiManager. The shared advisory describes arbitrary-command execution through crafted requests.
Impact: Unauthorised code or command execution, with confidentiality, integrity and availability impact in the per-CVE vector.
Conditions: The specific vendor CVSS vector specifies high privileges, PR:H. This is more specific than the shared advisory's general low-privileged-user summary.
CVE-2026-23707 - SQL injection across analysis and management products
Severity: Medium, following Fortinet's per-CVE CSAF rating.
Vendor-published CVSSv3: 6.5. NVD separately displays a CNA base score of 7.2, High.
Description: SQL injection, CWE-89, affects FortiAnalyzer, FortiAnalyzer Cloud, FortiManager and FortiManager Cloud. The shared advisory describes arbitrary-command execution through crafted requests.
Impact: Unauthorised code or command execution, with confidentiality, integrity and availability impact in the per-CVE vector.
Conditions: The specific vendor CVSS vector specifies high privileges, PR:H, despite the broader low-privileged-user wording in the shared summary.
CVE-2026-23706 - SQL injection affecting confidentiality
Severity: Medium, following Fortinet's per-CVE CSAF rating.
Vendor-published CVSSv3: 5.9. NVD separately displays a CNA base score of 6.5, Medium.
Description: SQL injection, CWE-89, affects FortiAnalyzer, FortiAnalyzer Cloud and FortiManager. Fortinet includes this CVE in its shared arbitrary file read/write and command-execution advisory.
Impact: The specific CVSS vector records high confidentiality impact, with no integrity or availability impact. The shared advisory does not provide a separate exploit narrative for this CVE.
Conditions: Authenticated access with low privileges, PR:L in the vendor vector.
CVE-2026-106171 - FortiManager fgfmd OS command injection
Severity: Medium.
Vendor-published CVSSv3: 5.3.
Description: OS command injection, CWE-78, affects the FortiManager fgfmd daemon and specified FortiManager Cloud releases. Crafted packets may be accepted from an attacker impersonating a cluster node.
Impact: Execution of unauthorised code or commands; Fortinet categorises the impact as privilege escalation.
Conditions: The attacker must possess the impersonated cluster node's certificate and private key. This is not an unrestricted unauthenticated attack.
CVE-2026-106172 - FortiSandbox API hard-coded cryptographic key
Severity: Medium.
Vendor-published CVSSv3: 4.9.
Description: A hard-coded cryptographic key, CWE-321, affects FortiSandbox and FortiSandbox Cloud APIs. Crafted HTTP requests may permit access to some endpoints.
Impact: Unauthorised API endpoint access; Fortinet categorises the impact as privilege escalation.
Conditions: No authentication is required. The vendor describes access to some endpoints, not a complete GUI authentication bypass.
CVE-2026-106170 - FortiSandbox persistent denial of service
Severity: Medium.
Vendor-published CVSSv3: 4.8.
Description: An uncaught exception, CWE-248, in FortiSandbox may be triggered through crafted HTTP requests.
Impact: Persistent loss of access to both the GUI and CLI.
Conditions: Privileged attacker access is required.
Mitigation
Prioritise critical exposures. Upgrade affected FortiSandbox and FortiSandbox PaaS GUI deployments using FG-IR-26-185. Upgrade FortiSIEM 7.5.0 to 7.5.1 or later in its branch using FG-IR-26-180.
Use the documented FortiSIEM workaround if patching is delayed. Fortinet states that restricting access on TCP port 27918 prevents the issue. This workaround applies to the FortiSIEM path traversal vulnerability, not the other CVEs. See Fortinet's FortiSIEM workaround.
Apply the product-specific SQL injection fixes. Follow Fortinet's analysis and management product upgrade matrix. Migrate FortiAnalyzer and FortiManager 7.2 deployments to a fixed release rather than assuming FortiAnalyzer Cloud's 7.2.12 fix applies to them.
Address both FortiManager advisory families. The SQL injection fix is 7.6.5 or later in that branch, but the separate command injection advisory requires 7.6.7 or later. FortiManager 8.0.0 requires 8.0.1 or later for command injection. See FG-IR-26-177.
Patch FortiMail appliances. Use the branch-specific fixes in FG-IR-26-184. FortiMail Cloud requires no customer action for this CVE according to Fortinet.
Plan FortiSandbox remediation across all three issues. FortiSandbox 4.4.10 addresses the GUI bypass, but the API and denial-of-service advisories require migration from all 4.4 versions. Follow the API advisory and the denial-of-service advisory. Confirm availability of fixes labelled upcoming, particularly FortiSandbox Cloud releases.
Check upgrade prerequisites. Review the FortiSIEM 7.5.1 release notes and implementation guidance and FortiManager 7.6.7 release-note review guidance before deployment.
Fortinet does not publish an additional workaround in the other six reviewed advisories. All seven state that a virtual patch is not available. Do not substitute generic hardening measures for the vendor fixes.
Summary for IT Teams
Products: FortiSandbox, FortiSandbox PaaS, FortiSandbox Cloud, FortiSIEM, FortiAnalyzer, FortiAnalyzer Cloud, FortiManager, FortiManager Cloud and FortiMail. FortiMail Cloud was already remediated by Fortinet.
Threat level: Critical overall, highest vendor-published CVSSv3 score 9.6. The 10 CVEs comprise two Critical, two High and six Medium ratings under Fortinet's published per-CVE classifications.
Action required: Identify affected versions, prioritise the unauthenticated critical issues, apply the listed branch-specific fixes, and migrate branches without an in-branch fix. Confirm upcoming-release availability with Fortinet. Restrict TCP port 27918 as the documented FortiSIEM workaround where required.
Reference
Official vendor sources
Fortinet FG-IR-26-185, FortiSandbox GUI authentication bypass.
Fortinet FG-IR-26-180, FortiSIEM path traversal and TCP 27918 workaround.
Fortinet FG-IR-26-178, multiple arbitrary file read/write via SQL injection.
Fortinet FG-IR-26-178 CSAF, per-CVE product mappings, scores and fixes.
Fortinet FG-IR-26-184, FortiMail webmail SQL injection and cloud remediation.
Fortinet FG-IR-26-177, FortiManager fgfmd OS command injection.
Fortinet FG-IR-26-179, FortiSandbox API hard-coded cryptographic key.
Fortinet FG-IR-26-176, FortiSandbox persistent denial of service.
FortiSIEM 7.5.1 release notes, What's New and implementation notes.
Supplied supplementary sources reviewed
NVD's structured affected-product entries differ from its narrative and Fortinet's current advisory in places. This report uses the current official Fortinet advisory and CSAF ranges. NVD's additional FG-IR-25-246 reference returned an unavailable-post message during research; the current FG-IR-26-178 advisory and its per-CVE CSAF records provide the version and remediation evidence used here.
Need Help?
If your organisation needs assistance assessing exposure or planning remediation, the Secure ISS SOC team is ready to help. Call 1300 769 460. We are here to help you strengthen your cybersecurity posture.
