Fortinet Patches Critical FortiSandbox and FortiSIEM Flaws Among 13 Vulnerabilities

TL;DR

Fortinet released 10 advisories on October 13, 2026, fixing 13 Fortinet vulnerabilities across eight product lines. Two are critical: an authentication bypass in FortiSandbox (CVSS 9.6) and an unauthenticated code execution flaw in FortiSIEM (CVSS 9.4). Neither requires a login.

Notable CVEs

Why It Matters

Fortinet gear sits at the heart of many corporate networks. FortiSandbox analyzes suspicious files, while FortiSIEM collects security logs. A takeover of either tool hands attackers a trusted view of the network they are trying to breach.

Attackers also watch Fortinet closely. Edge and security appliances from the vendor have been frequent targets in past campaigns. As a result, defenders should not wait to see whether these Fortinet vulnerabilities draw the same attention.

How the Attacks Work

CVE-2026-107656: FortiSandbox authentication bypass (CVSS 9.6)

This flaw lets a remote attacker skip login on the FortiSandbox web interface through an alternate path. Fortinet warns that “a remote unauthenticated attacker may be able to gain unauthorized access to the appliance.” Fortinet’s internal team and TrendAI Research both reported it.

CVE-2026-106173: FortiSIEM arbitrary file write (CVSS 9.4)

A path traversal bug in the phQueryMaster service lets an unauthenticated attacker write files and run code. Fortinet found the flaw internally.

SQL injection in FortiAnalyzer, FortiManager and FortiMail

Four CVEs, led by CVE-2025-46773 (CVSS 7.9), affect FortiAnalyzer and FortiManager. They “may allow a low privileged user to execute arbitrary commands via crafted requests.” Separately, CVE-2025-57739 (CVSS 7.7) lets an authenticated FortiMail webmail user run code through SQL injection.

Other fixes

• CVE-2026-106174 (CVSS 6.7): an unauthenticated attacker can crash the FortiOS HTTPS admin interface.
• CVE-2026-106171 (CVSS 5.3): command injection in the FortiManager fgfmd daemon, though it needs a stolen cluster node certificate and private key.
• CVE-2026-106172 (CVSS 4.9): a hard-coded key exposes some FortiSandbox API endpoints. watchTowr researcher Sina Kheirkhah reported it.
• Three lower-severity bugs: a FortiSandbox persistent DoS, a FortiSIEM authorization flaw and a FortiOS CLI crash reported by the UK’s NCSC.

Exploitation status

Fortinet does not report exploitation in the wild for any of these Fortinet vulnerabilities. No public proof-of-concept has been confirmed either.

Affected Versions

• FortiSandbox: 5.0.0 to 5.0.6 and 4.4.0 to 4.4.9. FortiSandbox 5.2 is not affected by the critical flaw.
• FortiSIEM: 7.5.0. FortiSIEM 7.6 and FortiSIEM Cloud are not affected.
• FortiAnalyzer and FortiManager: 7.6.0 to 7.6.4, the 7.4 branch, and all 7.2 releases.
• FortiMail: 7.6.0 to 7.6.3, 7.4.0 to 7.4.5 and 7.2.0 to 7.2.8.
• FortiOS: 8.0.0 and 7.6.4 to 7.6.6 for the GUI denial-of-service bug.

Patch and Mitigation Steps

• Upgrade FortiSandbox to 5.0.7 or 4.4.10.
• Upgrade FortiSIEM to 7.5.1. Until then, Fortinet says “restricting access on tcp port 27918 prevents the issue.”
• Move FortiAnalyzer to 7.6.5 or 7.4.8, and FortiManager to 7.6.5 or 7.4.7. Users on 7.2 should migrate to a fixed release.
• Upgrade FortiMail to 7.6.4, 7.4.6 or 7.2.9. FortiMail Cloud customers need no action.
• Upgrade FortiOS to 7.6.7, or apply FortiGuard virtual patch FG-VD-61291.

Full details for each advisory appear on the FortiGuard PSIRT portal. Patch the two critical, unauthenticated flaws first.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.