轉發 台灣電腦網路危機處理暨協調中心 資安訊息警訊 TWCERTCC-200-202610-00000017

[內容說明]
Fortinet 針對 FortiSandbox GUI 發布重大資安漏洞公告(CVE-2026-107656，CVSS：9.6)。此漏洞可能允許未經身分驗證的攻擊者，透過精心建構的HTTP請求繞過身分驗證。

[影響平台]
FortiSandbox 5.0.0至5.0.6版本、 FortiSandbox 4.4.0至4.4.9版本、 FortiSandbox PaaS 5.0.0至5.0.6版本、 FortiSandbox PaaS 4.4版本

[建議措施]
請更新至以下版本： FortiSandbox 5.0.7 (含)之後版本、 FortiSandbox 4.4.10 (含)之後版本、 FortiSandbox PaaS 5.0.7(含)之後版本

[參考資料]
1. https://www.twcert.org.tw/tw/cp-169-11281-14cf7-1.html
Forwarded from Taiwan Computer Emergency Response Team/Coordination Center Security Alert TWCERTCC-200-202610-00000017

[Description]
Fortinet has released a critical security vulnerability advisory for FortiSandbox GUI (CVE-2026-107656, CVSS: 9.6). This vulnerability may allow unauthenticated attackers to bypass authentication through specially crafted HTTP requests.

[Affected Platforms]
FortiSandbox versions 5.0.0 to 5.0.6, FortiSandbox versions 4.4.0 to 4.4.9, FortiSandbox PaaS versions 5.0.0 to 5.0.6, FortiSandbox PaaS version 4.4

[Recommendations]
Please update to the following versions: FortiSandbox version 5.0.7 or later, FortiSandbox version 4.4.10 or later, FortiSandbox PaaS version 5.0.7 or later

[References]
1. https://www.twcert.org.tw/tw/cp-169-11281-14cf7-1.html