ZDI-26-771: Fortinet FortiSandbox login_user_profile Hard-Coded Credentials Authentication Bypass Vulnerability

Summary by Cyber Security News15 Oct 2026, 07:00 CEST

About this summary. This is a short, independently written summary of an article first published by Zero Day Initiative. Cyber Security News did not report or verify the underlying story. Read the original: http://www.zerodayinitiative.com/advisories/ZDI-26-771/

This vulnerability allows remote attackers to bypass authentication on affected installations of Fortinet FortiSandbox. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3.

Read the full article at Zero Day Initiative →

Source attribution: headline and facts are from Zero Day Initiative (zerodayinitiative.com). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

ZDI-26-772: Fortinet FortiSandbox Admin Profile Improper Handling of Exceptional Conditions Denial-of-Service Vulnerability

NCSC-2026-0428 [1.00] [M/H] Kwetsbaarheden verholpen in Fortinet FortiSandbox

Fortinet sounds the alarm over actively exploited FortiMail zero-day

U.S. CISA adds Fortinet FortiMail flaw to its Known Exploited Vulnerabilities catalog

Thinking in Graphs: Neo4j-Backed Exploit-Chain Reasoning for LLM Penetration-Testing Agents

Can Autonomous Vehicles Keep Their Cool? A Survey of Thermal Side-Channel and Perception Attacks