Fortinet FortiSandbox and FortiSIEM: authentication bypass (CVE-2026-107656) and path traversal (CVE-2026-106173), FortiSIEM flaw exploited
CVE-2026-106170 CVE-2026-106172 CVE-2026-106173 CVE-2026-107656
Published 29/10/2026 10:39
Timeline
3 events over 15 d
- 13/10/2026 20:11UnconfirmedCommunity post+20 h
- 14/10/2026 16:31ConfirmedNCSC-NL advisories+14 d
- 29/10/2026 10:39Published on WatchtowerPro CISO
In short
Fortinet fixed a critical authentication bypass in FortiSandbox (CVE-2026-107656) and a critical path traversal in FortiSIEM 7.5.0 (CVE-2026-106173). VulnCheck lists the FortiSIEM flaw as exploited in the wild, and a public exploit exists. Update affected products and restrict access to their management interfaces. GreyNoise reports a public exploit for CVE-2026-106173 (27/10/2026).
How bad is it
Critical. An attacker who can reach a vulnerable FortiSandbox management interface can bypass the login and run their own commands, without needing an account.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 4 CVEs · CVSS from the vendor, via our research, read 29/10/2026. CVE-2026-106170, CVE-2026-106172: no score published yet.
What an attacker needs
- Internet access to itNot published yet
- A loginNot published yet
- A user to clickNot published yet
- Special settingsNot published yet
Red helps the attacker, blue holds them back, grey is not published yet.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- FortiSandbox 5.0.0 through 5.0.6
- FortiSIEM 7.5.0 (CVE-2026-106173); ACN lists only this version
What to do now
- FortiSandbox: update to 5.0.7 or later, or 4.4.10 or later; FortiSandbox PaaS: update to 5.0.7 or later (versions as listed by INCIBE).
- FortiSIEM 7.5.0: update to the fixed version in Fortinet's advisory.
- Interim measures reduce exposure and do not make a server safe.
- FortiSIEM: block or restrict TCP 27918 from untrusted networks.
- FortiSIEM: alert on gRPC/HTTP-2 metadata containing ../, encoded traversal or a null byte. Treat any change to the watched files as a possible compromise.
- FortiSandbox: NCSC-NL expects more scanning and abuse attempts, so review access logs for unusual HTTP requests to the management interface.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer and all 6 sources with their dates. And technology matching: which of your systems run Fortinet FortiSandbox, at which version, fixed or not - and what each one needs.
Main sources
NCSC-2026-0428 [1.00] [M/H] Kwetsbaarheden verholpen in Fortinet FortiSandbox CERT · Known exploited (VulnCheck KEV): Fortinet FortiSIEM - Fortinet FortiSIEM Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Research · Risolte vulnerabilità in prodotti Fortinet - ACN Research