SecBoard
Zurück zur CVE-Übersicht

CVE-2026-107656

CRITICAL(9.8)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score25/100 — MITTEL
  • CVSS 9.8 — Kritisch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.9%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

9.8

Technische Schwere

SecBoard-Einordnung

CVE-2026-107656 beschreibt eine kritische Authentifizierungsumgehung in Fortinet FortiSandbox und FortiSandbox PaaS. Die Schwachstelle ermöglicht es Angreifern, über speziell präparierte HTTP-Anfragen unautorisierten Code oder Befehle auszuführen. Dies kann zu einer vollständigen Kompromittierung des betroffenen Systems führen.

KI-gestützte Einordnung auf Basis der NVD-Daten.

Beschreibung

An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4.2 all versions may allow attacker to execute unauthorized code or commands via crafted HTTP requests

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • FortiSandbox 5.0.7
  • FortiSandbox 5.2.2
  • FortiSandbox PaaS 5.0.7
  • FortiSandbox Cloud 5.0.7
  • FortiSandbox Cloud 5.2.2

Threat-Hunting-Queries

This vulnerability allows an unauthenticated attacker to bypass authentication via crafted HTTP requests. Detection should focus on unusual or malformed HTTP requests targeting FortiSandbox GUI, especially those that bypass typical authentication mechanisms or lead to unauthorized command execution. Look for HTTP requests that deviate from normal user behavior or expected API calls.

Sentinel/Defender KQL

DeviceNetworkEvents
| where ActionType == "HttpConnection"
| where RemoteUrl contains "FortiSandbox" or InitiatingProcessCommandLine contains "FortiSandbox"
| where isnotempty(RemoteUrl)
| summarize RequestCount = count() by RemoteUrl, InitiatingProcessCommandLine, DeviceName
| where RequestCount > 100 // Adjust threshold based on baseline
| project RemoteUrl, InitiatingProcessCommandLine, DeviceName, RequestCount

Splunk SPL

sourcetype=fortisandbox_logs (http_request_method=* OR http_request_uri=*) | regex _raw="(?i)FortiSandbox" | stats count by http_request_uri, src_ip, user | where count > 100

Sigma

title: FortiSandbox Authentication Bypass Attempt
status: experimental
description: Detects potential authentication bypass attempts against FortiSandbox GUI via crafted HTTP requests.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107656
logsource:
  product: fortisandbox
  service: http
detection:
  selection:
    http_method: ["GET", "POST", "PUT", "DELETE"]
    url|contains: "FortiSandbox"
    # Add more specific patterns for crafted requests if known
  condition: selection
fields:
  - source_ip
  - destination_ip
  - url
  - http_method
level: high

Elastic ES|QL

from fortisandbox_logs
| where http.request.method in ("GET", "POST", "PUT", "DELETE")
| where http.request.url.full : "FortiSandbox"
| group by http.request.url.full, source.ip, destination.ip
| aggregate request_count = count()
| where request_count > 100

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen