FortiSandbox software contains an authentication bypass that permits an attacker to send specially crafted HTTP requests through an alternate channel or path, circumventing the normal login process. The flaw, identified as CWE‑288, allows the attacker to execute arbitrary code or commands on the sandbox platform, potentially compromising the integrity and confidentiality of all hosted workloads.

Vendors and products affected include Fortinet FortiSandbox and FortiSandbox PaaS. The vulnerability spans FortiSandbox versions 4.2.x, 4.4.0‑4.4.9, 5.0.0‑5.0.6, and FortiSandbox PaaS versions 4.2.x, 4.4.x, and 5.0.0‑5.0.6.

The CVSS score of 9.6 indicates a high severity, with the potential for remote code execution over the network. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be via over the network using crafted HTTP requests to an alternate authentication endpoint. Exploitation would require only network access to the FortiSandbox interface, making it highly feasible for attackers who can reach the service.