Vulnerabilities
FortiSandbox GUI Authentication Bypass Exploit (CVSS 9.6) – Immediate Mitigation Required
FortiSandbox web interface allows unauthenticated attackers to bypass login via crafted HTTP requests. CVSS 9.6 indicates critical risk. Defenders must patch, restrict GUI access, enable MFA, and monitor for anomalous traffic.
What happened
FortiSandbox's web management interface contains an authentication bypass flaw (CWE‑288). A remote attacker can send specially crafted HTTP requests that bypass the login process, gaining full administrative control without credentials.
Impact
Unauthenticated users can read, modify, or delete sandbox configurations, deploy malicious samples, and potentially pivot to other network assets. The flaw can be exploited from any network location that can reach the GUI.
Mitigation
- Apply the latest FortiSandbox firmware that addresses the CVSS 9.6 issue.
- Limit GUI access to trusted IP ranges or VPN endpoints.
- Enable two‑factor authentication for all web‑UI logins.
- Disable the web‑UI if it is not required for day‑to‑day operations.
- Patch any other FortiSandbox instances that may be exposed.
Monitoring & Response
Enable logging of all HTTP requests to the GUI and alert on patterns matching the bypass request signatures. Review audit logs for unauthorized configuration changes and conduct a forensic analysis if an incident is suspected.
“The vulnerability is exploitable without any prior authentication, making it a high‑priority patch item for all exposed FortiSandbox deployments.”
Related vulnerabilities
Ivanti Connect Secure Zero‑Day Exploited: Immediate Patch Required
An actively exploited authentication‑bypass zero‑day (CVE‑2026‑104935) has been found in Ivanti Connect Secure. The flaw affects versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier, allowing unauthenticated remote attackers to run arbitrary commands. Defenders must patch immediately and run the Integrity Checker Tool.
Read briefing
Microsoft Exchange Improper Authorization Privilege Escalation (CVE‑2026‑62911) – Immediate Patch Required
A remote privilege‑escalation flaw in Microsoft Exchange Server (CVE‑2026‑62911) allows authenticated attackers to bypass authorization and gain SYSTEM rights. The vulnerability is CVSS 8.8 and is already patched by Microsoft. Defenders must apply the update, verify session handling, and monitor for suspicious elevation attempts.
Read briefing
Schneider Electric PowerChute Serial Shutdown Vulnerability (CVE‑2026‑13348) – Immediate Patch Required
Schneider Electric’s PowerChute Serial Shutdown UPS management software is affected by a CVE‑2026‑13348 flaw that allows unlimited authentication attempts when redirect handling is disabled. The issue could enable attackers to bypass login controls and disrupt critical infrastructure operations. Versions up to 1.5 and 1.6 are impacted; the vendor’s v1.6 patch restores proper authentication limits. Operators must download and install the update for Windows and Linux immediately, then verify the new version via the Control Panel or PCSS About page.
Read briefing
Cisco ISE Zero‑Day Exploited in the Wild – Immediate Patch Required
Cisco’s Identity Services Engine (ISE) is under attack. The CVE‑2026‑76460 vulnerability, rated maximum severity, lets remote actors bypass authentication by sending crafted API requests. Cisco has released fixed releases for ISE and ISE‑PIC, but no workarounds exist. The company urges customers to apply the patch immediately, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog, mandating federal agencies patch within three days.
Read briefing