Your FortiSIEM and FortiSandbox boxes have no-login bugs. Upgrade them before attackers go looking

Fortinet’s October advisories include two critical bugs in the tools security teams use to watch everything else. One lets an attacker with no account run code on a FortiSIEM server. The other lets an attacker skip the login on a FortiSandbox.

Fortinet says neither has been exploited. Both can be reached without a login, so they belong on this week’s list.

FortiSIEM sees every log you collect. A no-login bug on it should be patched before attackers start looking for it.
The 5-Minute Cyber Brief
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
Email address
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.

Fortinet fixes no-login bugs in FortiSIEM and FortiSandbox

FortiSIEM: Fortinet’s advisory FG-IR-26-180 describes a path traversal in the phQueryMaster service, tracked as CVE-2026-106173 with a CVSS score of 9.4, that “may allow an unauthenticated attacker to execute unauthorized code or commands via specially crafted packets.” Fortinet found it internally.

FortiSandbox: advisory FG-IR-26-185 covers an authentication bypass in the web interface (CVSS 9.6) that may let a remote attacker with no account bypass authentication with crafted HTTP requests. Fortinet lists a CVE ID for it, but the public CVE record had not been published as of Tuesday night.

The same batch fixes SQL injection bugs in FortiAnalyzer, FortiManager and FortiMail webmail, rated High.

FortiSIEM 7.5.0 and FortiSandbox 4.4 and 5.0

Only FortiSIEM 7.5.0 is affected by the FortiSIEM bug. Fortinet says 7.6 and FortiSIEM Cloud are not. For FortiSandbox, 5.0.0 through 5.0.6 and 4.4.0 through 4.4.9 are affected, along with FortiSandbox PaaS 5.0 and 4.4. Version 5.2 is not.

Both products sit in a trusted spot. FortiSIEM collects the logs your team relies on to spot an intrusion, and FortiSandbox is where suspicious files get sent for analysis. An attacker on either box sees what your defenders see.

Upgrade both, or close FortiSIEM port 27918

Upgrade FortiSIEM 7.5.0 to 7.5.1 or later. Until then, restrict access to TCP port 27918, which Fortinet says prevents the issue.
Upgrade FortiSandbox to 5.0.7 or 4.4.10. FortiSandbox PaaS 4.4 users need to move to a fixed release.
Make sure neither management interface is reachable from the internet.
Queue the FortiAnalyzer, FortiManager and FortiMail updates for the next window.

Forward this

For whoever runs our Fortinet security tools: Fortinet fixed two critical no-login bugs, one in FortiSIEM 7.5.0 and one in FortiSandbox 4.4 and 5.0. Neither is reported exploited yet. Can we upgrade both this week, and block port 27918 on FortiSIEM until then?

Details

CVE-2026-106173 (FG-IR-26-180): FortiSIEM 7.5.0, path traversal in phQueryMaster, unauthenticated code execution, CVSS 9.4. Fixed in 7.5.1. Workaround: restrict TCP 27918.
FG-IR-26-185: FortiSandbox GUI authentication bypass (CWE-288), CVSS 9.6. Affected 5.0.0–5.0.6 and 4.4.0–4.4.9; fixed in 5.0.7 and 4.4.10. CVE record not yet public.
Also High: FortiAnalyzer/FortiManager SQL injection (CVE-2025-46773, FG-IR-26-178); FortiMail webmail SQL injection (CVE-2025-57739, FG-IR-26-184).
Exploitation: Fortinet lists “Known Exploited: No” for both critical bugs as of October 13, 2026.

Hunt / verify

Connections to TCP 27918 on FortiSIEM from hosts that are not FortiSIEM collectors or workers.
New files in FortiSIEM directories outside normal upgrade dates.
FortiSandbox admin sessions with no matching login event.

Slack paste: Fortinet Oct: FortiSIEM 7.5.0 no-login RCE (CVE-2026-106173, 9.4) -> 7.5.1 or block TCP 27918; FortiSandbox auth bypass (9.6) -> 5.0.7 / 4.4.10. Not exploited yet.

Sources

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].