---METADATA---
VENDOR: Fortinet
PRODUCT: FortiAuthenticator
AFFECTED_VERSIONS: 8.0.2, 8.0.0, 6.6.0 through 6.6.8, 6.5.0 through 6.5.6, 6.4.0 through 6.4.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An improper access control vulnerability in FortiAuthenticator allows unauthenticated attackers to execute unauthorized code or commands.

Executive Summary:
A critical access control flaw in Fortinet FortiAuthenticator allows unauthenticated remote code execution, posing a severe threat to internal network security.

Vulnerability Details

CVE-ID: CVE-2026-44277

Affected Software: Fortinet FortiAuthenticator

Affected Versions: 8.0.2, 8.0.0, 6.6.0 through 6.6.8, 6.5.0 through 6.5.6, 6.4.0 through 6.4.10

Vulnerability: The vulnerability involves improper access control (CWE-284) that allows an unauthenticated remote attacker (per CVSS vector PR:N) to execute arbitrary code or commands on the underlying system.

Business Impact

The potential for unauthenticated remote code execution makes this a critical risk, as it allows attackers to gain full control over the appliance. Given the CVSS score of 9.8, this could lead to total compromise of identity and authentication services, enabling lateral movement throughout the organization and severe data theft.

Remediation Plan

Immediate Action: Upgrade to FortiAuthenticator version 8.0.3, 8.0.1, 6.6.9, 6.5.7, 6.4.11, or 6.3.5 immediately.

Proactive Monitoring: Monitor system logs for unauthorized administrative logins or unexpected process execution patterns originating from the FortiAuthenticator appliance.

Compensating Controls: Restrict management interface access to trusted IP addresses using firewall rules to limit the exposure of the vulnerable service to untrusted networks.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept repository exists on GitHub.

Analyst Notes: As of May 12, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept exists on GitHub, and the vulnerability is highly automatable, making the risk of near-term exploitation significant.

Analyst Recommendation

Due to the unauthenticated nature of this vulnerability and the availability of public proof-of-concept code, this issue represents a high-priority risk. Administrators must prioritize patching these appliances immediately to prevent potential remote system compromise.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiSandbox
AFFECTED_VERSIONS: FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8
---END_METADATA---

Description Summary:
A path traversal vulnerability in Fortinet FortiSandbox allows unauthenticated attackers to achieve privilege escalation via crafted file paths.

Executive Summary:
A critical path traversal vulnerability in Fortinet FortiSandbox allows unauthenticated attackers to escalate privileges and compromise the system.

Vulnerability Details

CVE-ID: CVE-2026-39813

Affected Software: Fortinet FortiSandbox

Affected Versions: FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8

Vulnerability: This is a path traversal flaw residing in the file directory handling logic, which can be triggered by an unauthenticated attacker to manipulate system files and escalate privileges.

Business Impact

With a CVSS score of 9.8, this vulnerability poses an extreme risk to organizational security. Successful exploitation allows an attacker to bypass security boundaries, potentially leading to full system compromise, unauthorized access to sensitive sandbox data, and the ability to execute arbitrary code with elevated privileges.

Remediation Plan

Immediate Action: Update FortiSandbox to the latest vendor-supplied version immediately to patch the directory traversal flaw.

Proactive Monitoring: Review system access logs for anomalous directory traversal patterns or unexpected file modification attempts targeting internal system directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) or intrusion prevention system (IPS) with rulesets configured to detect and block directory traversal sequences (e.g., ../) in incoming traffic.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 14, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity, administrators must prioritize patching affected FortiSandbox appliances. The ability for an unauthenticated attacker to achieve privilege escalation represents a severe threat to the integrity and confidentiality of the entire network segment where the sandbox resides.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiSandbox
AFFECTED_VERSIONS: FortiSandbox 4.4.0 through 4.4.8, FortiSandbox PaaS 23.4.4374, 23.4.4350, 23.3.4329, 23.1.4245, 22.2.4151, 22.2.4134, 22.1.4113, 21.4.4072
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Fortinet FortiSandbox is vulnerable to OS command injection, allowing unauthenticated attackers to execute unauthorized code on the appliance.

Executive Summary:
A critical OS command injection vulnerability in Fortinet FortiSandbox allows unauthenticated remote attackers to execute arbitrary code with elevated privileges.

Vulnerability Details

CVE-ID: CVE-2026-39808

Affected Software: Fortinet FortiSandbox

Affected Versions: See metadata for specific version strings.

Vulnerability: This is an OS command injection flaw (CWE-78) where insufficient neutralization of special elements allows attackers to execute unauthorized commands. The vulnerability is remotely exploitable without authentication, making it highly dangerous.

Business Impact

The CVSS score of 9.8 justifies the critical status of this vulnerability. An attacker exploiting this flaw gains complete control over the security appliance, which can be used to bypass security policies, intercept internal traffic, or serve as a beachhead for lateral movement within the enterprise network.

Remediation Plan

Immediate Action: Upgrade to FortiSandbox version 4.4.9 or above, or FortiSandbox PaaS version 5.0.2 or above, as recommended by the vendor.

Proactive Monitoring: Monitor for unexpected command execution patterns or unauthorized changes to system configurations via the management interface.

Compensating Controls: Restrict management interface access to authorized administrative IP addresses via ACLs to prevent unauthenticated access.

Exploitation Status

Public Exploit Available: Yes — multiple proof-of-concept repositories exist on GitHub.

Analyst Notes: As of April 22, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of multiple PoCs indicates the vulnerability is well-understood by researchers and potential attackers.

Analyst Recommendation

Given the critical nature of this vulnerability and the availability of public proof-of-concept code, immediate patching is mandatory. Organizations should verify their versions against the vendor's advisory and apply the updates as the highest priority to prevent potential compromise.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiClientEMS
AFFECTED_VERSIONS: 7.4.5 through 7.4.6
---END_METADATA---

Description Summary:
Fortinet FortiClientEMS versions 7.4.5 and 7.4.6 contain an improper access control vulnerability. Unauthenticated attackers can execute unauthorized code or commands via crafted requests.

Executive Summary:
Fortinet FortiClientEMS is vulnerable to unauthenticated remote command execution due to improper access controls, posing a critical risk to endpoint management infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-35616

Affected Software: Fortinet FortiClientEMS

Affected Versions: 7.4.5 through 7.4.6

Vulnerability: This vulnerability involves improper access control within the FortiClientEMS management server. An unauthenticated attacker can send specially crafted network requests to the server to execute unauthorized code or OS commands.

Business Impact

Compromise of a FortiClientEMS server is a tier-0 security event, as it allows an attacker to potentially control all connected endpoints. The CVSS score of 9.8 reflects the extreme severity of unauthenticated code execution on a central security management platform. This could lead to enterprise-wide ransomware or data exfiltration.

Remediation Plan

Immediate Action: Update Fortinet FortiClientEMS to the latest patched version (refer to the vendor advisory for specific build numbers) immediately.

Proactive Monitoring: Monitor FortiClientEMS logs for anomalous requests and check for unauthorized administrative accounts or changes in endpoint policies.

Compensating Controls: Restrict access to the FortiClientEMS management ports to trusted administrative IP addresses using a hardware firewall.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 4, 2026, there is no public information indicating active exploitation of this vulnerability. However, Fortinet products are frequent targets for advanced persistent threat (APT) groups, making immediate patching vital.

Analyst Recommendation

Because FortiClientEMS manages the security posture of all corporate endpoints, this vulnerability represents a critical path for attackers to achieve total environment compromise. Apply the vendor-provided updates immediately and perform a retrospective log analysis to ensure the system has not already been compromised.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiSandbox
AFFECTED_VERSIONS: FortiSandbox 5.0.0-5.0.1, 4.4.0-4.4.8; FortiSandbox Cloud 5.0.2-5.0.5; FortiSandbox PaaS (various)
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A missing authorization vulnerability in multiple FortiSandbox versions allows unauthenticated attackers to execute arbitrary code or commands via crafted HTTP requests.

Executive Summary:
Critical missing authorization in Fortinet FortiSandbox allows unauthenticated remote code execution, posing a severe risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-26083

Affected Software: Fortinet FortiSandbox

Affected Versions: FortiSandbox 5.0.0 through 5.0.1, 4.4.0 through 4.4.8; FortiSandbox Cloud 5.0.2 through 5.0.5; various FortiSandbox PaaS versions.

Vulnerability: This is a missing authorization flaw where the application fails to validate the identity of a requester. An unauthenticated attacker can leverage this to execute unauthorized code or commands on the host system via malicious HTTP requests.

Business Impact

The vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation would grant an attacker complete control over the security appliance, potentially leading to unauthorized data exfiltration, lateral movement within the network, or complete service disruption.

Remediation Plan

Immediate Action: Apply the latest firmware patches provided by Fortinet immediately to all affected FortiSandbox and PaaS instances.

Proactive Monitoring: Inspect web access logs for unusual HTTP requests or unexpected command execution patterns targeting the management interface.

Compensating Controls: Restrict access to the FortiSandbox management interface to trusted IP addresses only using firewall rules or Access Control Lists (ACLs).

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS score and the ability for unauthenticated remote code execution, organizations must prioritize patching this vulnerability. Failure to remediate exposes the internal network to significant risk; ensure all FortiSandbox environments are updated to the latest vendor-released version without delay.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiWeb
AFFECTED_VERSIONS: 8.0.0-8.0.2, 7.6.0-7.6.6, 7.4.0-7.4.11, 7.2.0-7.2.12, 7.0.0-7.0.12
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Fortinet FortiWeb contains an improper authentication vulnerability that allows unauthenticated remote attackers to bypass security controls.

Executive Summary:
A critical improper authentication vulnerability in Fortinet FortiWeb allows unauthenticated remote attackers to achieve full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-26035

Affected Software: Fortinet FortiWeb

Affected Versions: 8.0.0 through 8.0.2, 7.6.0 through 7.6.6, 7.4.0 through 7.4.11, 7.2.0 through 7.2.12, and 7.0.0 through 7.0.12.

Vulnerability: This is an improper authentication vulnerability (CWE-287) residing within the FortiWeb appliance. The vulnerability can be exploited by an unauthenticated attacker over the network, requiring no user interaction.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting its high severity and potential for total system compromise. Successful exploitation allows an attacker to bypass authentication mechanisms, potentially leading to unauthorized data access, administrative control over the web application firewall, and broad lateral movement within the network.

Remediation Plan

Immediate Action: Upgrade to FortiWeb version 8.0.3, 7.6.7, 7.4.12, or the upcoming 7.2.13 and 7.0.13 releases as specified by the vendor.

Proactive Monitoring: Monitor system logs for unusual authentication patterns or unauthorized access attempts originating from external or untrusted network segments.

Compensating Controls: While no direct virtual patch is specified, ensure that access to the FortiWeb management interface is restricted to trusted management networks via IP whitelisting.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the lack of authentication requirements and the ability to trigger the flaw remotely.

Analyst Recommendation

Given the high CVSS score and the critical nature of the affected appliance, organizations should prioritize patching affected FortiWeb instances immediately. Failure to address this flaw leaves the perimeter infrastructure vulnerable to complete takeover by unauthenticated actors.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiSandbox
AFFECTED_VERSIONS: FortiSandbox 5.0.0-5.0.5, 4.4.0-4.4.8, 4.2 all, Cloud 5.0.4-5.0.5, PaaS 5.0.4-5.0.5
---END_METADATA---

Description Summary:
An OS command injection vulnerability in FortiSandbox allows unauthenticated attackers to execute unauthorized commands via specifically crafted HTTP requests.

Executive Summary:
A critical OS command injection vulnerability in Fortinet FortiSandbox allows unauthenticated remote attackers to execute arbitrary system commands.

Vulnerability Details

CVE-ID: CVE-2026-25089

Affected Software: Fortinet FortiSandbox

Affected Versions: FortiSandbox 5.0.0 through 5.0.5, 4.4.0 through 4.4.8, 4.2 all versions, Cloud 5.0.4 through 5.0.5, and PaaS 5.0.4 through 5.0.5.

Vulnerability: This vulnerability arises from improper neutralization of special elements used in OS commands, permitting an unauthenticated attacker to inject and execute unauthorized commands via malicious HTTP requests.

Business Impact

With a CVSS score of 9.8, this flaw poses a severe threat, as it allows complete administrative control over the security appliance without requiring prior authentication. A compromise of FortiSandbox—a critical security tool—could allow attackers to bypass security controls, exfiltrate sensitive data, or pivot into the internal network.

Remediation Plan

Immediate Action: Update to FortiSandbox 5.0.6, 4.4.9, or higher, depending on the specific product line, as detailed in the vendor advisory.

Proactive Monitoring: Monitor device logs for signs of suspicious HTTP requests or unexpected command execution attempts on the FortiSandbox appliance.

Compensating Controls: Use a Web Application Firewall (WAF) to filter malicious HTTP input that could trigger command injection while the patching process is underway.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jun 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the unauthenticated nature of the attack vector, this vulnerability is a high-priority target for threat actors. Administrators must apply the vendor-provided patches immediately to prevent unauthorized access and maintain the integrity of their security infrastructure.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiClientEMS
AFFECTED_VERSIONS: 7.4.4
---END_METADATA---

Description Summary:
An unauthenticated SQL injection vulnerability in Fortinet FortiClientEMS 7.4.4 allows for unauthorized code or command execution via crafted HTTP requests.

Executive Summary:
A critical SQL injection vulnerability in Fortinet FortiClientEMS allows an unauthenticated remote attacker to execute arbitrary commands and compromise the management server.

Vulnerability Details

CVE-ID: CVE-2026-21643

Affected Software: Fortinet FortiClientEMS

Affected Versions: 7.4.4

Vulnerability: The flaw stems from the improper neutralization of special elements within SQL commands. By sending specifically crafted HTTP requests to the EMS server, an unauthenticated attacker can manipulate database queries to execute unauthorized code or system-level commands.

Business Impact

Successful exploitation grants an attacker full control over the FortiClientEMS server, which manages endpoint security across the entire enterprise. This could lead to the deployment of malware to endpoints, theft of sensitive credentials, or total disruption of security operations. The CVSS score of 9.8 reflects the critical risk to the organization's security posture.

Remediation Plan

Immediate Action: Update Fortinet FortiClientEMS to the latest patched version (refer to Fortinet advisory for version 7.4.5 or higher) immediately.

Proactive Monitoring: Inspect web server and database logs for common SQL injection patterns, such as unexpected single quotes or UNION SELECT statements in HTTP parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious traffic targeting the FortiClientEMS management interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 6, 2026, there is no public information indicating active exploitation of this vulnerability. SQL injection in management consoles is a highly sought-after vector for initial access.

Analyst Recommendation

This vulnerability represents a significant threat to the centralized security management of an organization. Because it is unauthenticated and leads to remote code execution, it must be treated with the highest urgency. We recommend applying the vendor's patch within 24 hours to mitigate the risk of a full-scale network compromise.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiSIEM
AFFECTED_VERSIONS: 7.4.0, 7.3.0-7.3.4, 7.2.6, 7.1.8, 7.0.4, 6.7.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An OS command injection vulnerability in Fortinet FortiSIEM allows unauthenticated attackers to execute arbitrary code or commands via crafted TCP requests.

Executive Summary:
A critical OS command injection vulnerability in Fortinet FortiSIEM allows for unauthenticated remote code execution via crafted TCP requests.

Vulnerability Details

CVE-ID: CVE-2025-64155

Affected Software: Fortinet FortiSIEM

Affected Versions: 7.4.0, 7.3.0 through 7.3.4, 7.2.6, 7.1.8, 7.0.4, 6.7.10

Vulnerability: This is an OS command injection flaw (CWE-78) that occurs due to improper neutralization of special elements in TCP requests. The vulnerability is exploitable by an unauthenticated attacker over the network.

Business Impact

Successful exploitation allows an attacker to gain full control over the affected FortiSIEM instance, potentially leading to unauthorized access to sensitive security data and the ability to pivot into internal networks. The CVSS score of 9.8 reflects the high risk of total system compromise.

Remediation Plan

Immediate Action: Upgrade to FortiSIEM version 7.5.0, 7.4.1, 7.3.5, 7.2.7, or 7.1.9, depending on your current release branch.

Proactive Monitoring: Monitor network traffic for anomalous TCP connections directed at the FortiSIEM infrastructure and inspect logs for unauthorized command execution patterns.

Compensating Controls: Implement strict network access control lists (ACLs) to restrict access to the FortiSIEM interface to authorized management subnets only.

Exploitation Status

Public Exploit Available: Yes — multiple public proof-of-concept repositories are available on GitHub.

Analyst Notes: As of Jan 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of public PoC code significantly lowers the barrier for attackers to develop functional exploits.

Analyst Recommendation

Given the availability of public proof-of-concept code and the ease of exploitation, this vulnerability requires immediate patching. Administrators should verify their FortiSIEM version and apply the recommended vendor updates without delay.

Executive Summary:
A critical vulnerability has been identified in multiple versions of Fortinet FortiWeb that allows an unauthenticated attacker to bypass the FortiCloud Single Sign-On (SSO) authentication. Successful exploitation could grant an attacker unauthorized administrative access to the FortiWeb appliance, posing a significant risk to the security of protected web applications and sensitive data.

Vulnerability Details

CVE-ID: CVE-2025-59719

Affected Software: Fortinet FortiWeb

Affected Versions:

• FortiWeb 8.0.0
• FortiWeb 7.6.0 through 7.6.4
• FortiWeb 7.4.0 through 7.4.9

Vulnerability:
The vulnerability is an improper verification of a cryptographic signature within the Security Assertion Markup Language (SAML) Single Sign-On (SSO) authentication process for FortiCloud. An unauthenticated, remote attacker can exploit this flaw by sending a specially crafted SAML response to the FortiWeb appliance. The system fails to correctly validate the digital signature of the SAML assertion, leading it to accept a fraudulent authentication claim, which allows the attacker to bypass the login mechanism and gain unauthorized access.

Business Impact

This vulnerability is rated as critical with a CVSS score of 9.8, indicating a high potential for severe impact. A successful exploit would grant an unauthenticated attacker administrative access to the FortiWeb appliance. This could lead to the complete compromise of the organization's web application security posture, allowing the attacker to disable security policies, exfiltrate sensitive data passing through the WAF, and launch further attacks against backend web applications. The potential consequences include significant data breaches, application downtime, reputational damage, and regulatory penalties.

Remediation Plan

Immediate Action:
Organizations must immediately prioritize patching affected Fortinet FortiWeb appliances by updating to the latest version. Administrators should consult the official Fortinet security advisory for specific patched versions and detailed upgrade instructions. After patching, review access logs for any signs of compromise that may have occurred prior to remediation.

Proactive Monitoring:
Security teams should actively monitor for signs of exploitation. This includes reviewing FortiWeb access and authentication logs for anomalous SSO login attempts, particularly those involving malformed or unexpected SAML assertions. Monitor for any unauthorized or suspicious configuration changes to security policies, user accounts, or system settings. Network traffic analysis may reveal unusual communication patterns to and from the FortiWeb management interface.

Compensating Controls:
If immediate patching is not feasible, implement compensating controls to reduce the attack surface. Restrict network access to the FortiWeb management interface to a limited set of trusted IP addresses using firewall rules. If possible, place the management interface on a segregated, internal network segment, inaccessible from the public internet.

Exploitation Status

Public Exploit Available: False

Analyst Notes:
As of the publication date, December 9, 2025, there are no known public proof-of-concept exploits or reports of this vulnerability being actively exploited in the wild. However, given the critical CVSS score of 9.8 and the low complexity of a potential attack, security researchers and threat actors are expected to develop exploits rapidly. Organizations should assume imminent exploitation and act accordingly.

Analyst Recommendation

This vulnerability represents a critical risk to the organization and requires immediate attention. Due to the CVSS score of 9.8, which signifies a trivial-to-exploit vulnerability that can lead to a complete system compromise by an unauthenticated attacker, we strongly recommend applying the vendor-supplied patches to all affected FortiWeb instances on an emergency basis. Although this CVE is not yet on the CISA Known Exploited Vulnerabilities (KEV) catalog, its severity makes it a prime target for future exploitation. Prioritize patching and monitoring to prevent a potential compromise of your web application security infrastructure.

Executive Summary:
A high-severity OS Command Injection vulnerability has been discovered in multiple Fortinet products, including FortiWeb. This flaw allows a remote attacker to execute arbitrary commands on the affected device, potentially leading to a full system compromise, data theft, and further intrusion into the corporate network. Due to confirmed active exploitation in the wild, this vulnerability presents a critical and immediate risk to the organization.

Vulnerability Details

CVE-ID: CVE-2025-58034

Affected Software: Fortinet Multiple Products

Affected Versions: The vulnerability is confirmed in FortiWeb version 8. See the official Fortinet security advisory for a complete list of affected products and versions.

Vulnerability: This vulnerability is an OS Command Injection, classified under CWE-78. It arises because a component within the FortiWeb software fails to properly sanitize user-supplied input before passing it to the underlying operating system for execution. An unauthenticated remote attacker can craft a special request containing malicious shell metacharacters (e.g., ;, |, &&) which are then executed by the system with the privileges of the application. Successful exploitation grants the attacker the ability to run arbitrary commands on the target device.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.2. A successful exploit would grant an attacker complete control over the compromised Fortinet appliance, which often serves as a critical perimeter security device. The business impact includes the potential for sensitive data exfiltration, interception and manipulation of network traffic, and using the compromised device as a pivot point to launch further attacks against the internal network. The operational disruption and reputational damage from a compromised security appliance are significant, potentially leading to widespread system outages and regulatory fines.

Remediation Plan

Immediate Action: Immediately identify all vulnerable Fortinet appliances within the environment. Apply the security updates provided by Fortinet without delay, following your organization's emergency change management process. After patching, review system and access logs for any signs of compromise that may have occurred prior to the update.

Proactive Monitoring: Enhance monitoring of all affected devices. Specifically, search access logs for unusual or malformed requests, especially those containing shell command syntax. Monitor for unexpected outbound network connections from the device's management interface, the creation of new user accounts, and any anomalous system processes or CPU/memory utilization spikes.

Compensating Controls: If immediate patching is not feasible, restrict access to the device's management interface to a secure, isolated management network or a limited set of trusted IP addresses. Implement strict firewall rules to block all non-essential inbound and outbound traffic to and from the appliance itself.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of November 18, 2025, this vulnerability is being actively exploited in the wild. Its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog confirms that threat actors are leveraging this flaw in real-world attacks. The short remediation deadline of November 24, 2025, for U.S. federal agencies highlights the critical nature and widespread threat posed by this vulnerability.

Analyst Recommendation

Given the high severity of this OS Command Injection vulnerability, its presence on critical perimeter security devices, and its confirmed status as being actively exploited, immediate action is required. We strongly recommend that all affected Fortinet products be patched on an emergency basis, treating this as a critical priority. The risk of compromise is extremely high, and organizations should assume they are being actively targeted by threat actors seeking to exploit this flaw.

Executive Summary:
A high-severity path traversal vulnerability has been identified in the Fortinet FortiDLP Agent for MacOS. This flaw could allow an unauthenticated attacker to access, modify, or delete files outside of the intended directories on an affected system, potentially leading to sensitive data exposure or a full system compromise. Organizations are strongly advised to apply the vendor-supplied security patches immediately to mitigate this risk.

Vulnerability Details

CVE-ID: CVE-2025-54658

Affected Software: Fortinet FortiDLP Agent for MacOS

Affected Versions: See vendor advisory for specific affected versions.

Vulnerability: The vulnerability is an Improper Limitation of a Pathname to a Restricted Directory, commonly known as Path Traversal (CWE-22). It exists within the Outlookproxy plugin of the Fortinet FortiDLP Agent. The application fails to properly validate or sanitize user-supplied input that is used to construct file paths. A remote or local attacker could craft a malicious input containing "dot-dot-slash" (../) sequences to navigate the file system and access or manipulate files and directories outside the restricted folder, using the permissions of the FortiDLP agent process.

Business Impact

This vulnerability is rated as High severity with a CVSS score of 7.8. Successful exploitation poses a significant risk to the confidentiality, integrity, and availability of the affected macOS endpoint. An attacker could potentially read sensitive corporate data, modify critical application or system files to enable further compromise, or delete essential data, leading to operational disruption. Given that FortiDLP is a security product, its compromise could undermine the organization's overall security posture and lead to a serious data breach.

Remediation Plan

Immediate Action: Apply vendor security updates immediately. Fortinet has released patches to address this vulnerability, and system administrators should prioritize their deployment across all affected macOS endpoints. After patching, monitor for any signs of post-exploitation activity and review file access logs for suspicious behavior preceding the update.

Proactive Monitoring: Security teams should monitor for indicators of compromise, including unusual file access patterns originating from the FortiDLP agent process. Specifically, review application and system logs for any file path inputs containing traversal sequences like ../. Endpoint Detection and Response (EDR) solutions should be configured to alert on unexpected file modifications or deletions in sensitive system directories.

Compensating Controls: If immediate patching is not feasible, organizations should consider implementing compensating controls. This includes applying stricter file permissions and access control lists (ACLs) to limit the FortiDLP agent's ability to write to critical directories. Additionally, ensure endpoint security solutions are in place to detect and block anomalous file system activity.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of October 16, 2025, there are no known public proof-of-concept exploits or active exploitation campaigns targeting this vulnerability. However, vulnerabilities in widely deployed enterprise security products are prime targets for threat actors, and the public disclosure may accelerate exploit development.

Analyst Recommendation

Given the high severity rating (CVSS 7.8) and the potential for complete system compromise, immediate remediation is critical. We strongly recommend that all organizations using the affected Fortinet FortiDLP Agent on MacOS prioritize the deployment of the vendor-provided patches. Although this CVE is not currently listed on the CISA KEV list, its presence in a security product makes it a high-value target. Proactive patching is the most effective defense against potential future exploitation.

---METADATA---
VENDOR: Fortinet
PRODUCT: FortiFone
AFFECTED_VERSIONS: 7.0.0-7.0.1, 3.0.13-3.0.23
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A sensitive information exposure vulnerability in Fortinet FortiFone allows unauthenticated attackers to retrieve device configurations via crafted HTTP or HTTPS requests.

Executive Summary:
An unauthenticated information exposure vulnerability in Fortinet FortiFone allows attackers to extract sensitive device configuration data.

Vulnerability Details

CVE-ID: CVE-2025-47855

Affected Software: Fortinet FortiFone

Affected Versions: 7.0.0 through 7.0.1, 3.0.13 through 3.0.23

Vulnerability: This is an improper access control vulnerability (CWE-200) that allows an unauthenticated attacker to obtain device configuration files through crafted HTTP/HTTPS requests.

Business Impact

The exposure of device configurations can reveal sensitive information, such as authentication credentials, network topology, or internal settings, which can be leveraged for further attacks or lateral movement. The CVSS score of 9.8 highlights the potential for severe impact on the confidentiality and integrity of the affected devices.

Remediation Plan

Immediate Action: Upgrade FortiFone firmware to version 7.2.0, 7.0.2, or 3.0.24, depending on the current version installed.

Proactive Monitoring: Monitor HTTP/HTTPS traffic to FortiFone devices for unusual request patterns or attempts to access configuration-related endpoints.

Compensating Controls: Isolate FortiFone devices within a dedicated management VLAN and restrict access to the management interface via firewall rules.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the lack of authentication required to retrieve the configuration data.

Analyst Recommendation

Information disclosure vulnerabilities are often precursors to more complex attacks. Organizations using the affected FortiFone models should apply the vendor-provided firmware updates immediately to prevent unauthorized access to sensitive configuration data.

Executive Summary:
A critical SQL Injection vulnerability, identified as CVE-2025-25257, exists in multiple versions of Fortinet's FortiWeb product. This flaw allows an unauthenticated attacker to execute arbitrary SQL commands on the system, which could lead to a complete compromise of the appliance, data theft, and unauthorized system access. Due to its critical severity rating (CVSS 9.8), immediate patching is required to prevent potential exploitation.

Vulnerability Details

CVE-ID: CVE-2025-25257

Affected Software: Fortinet FortiWeb

Affected Versions: 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.x. See vendor advisory for a complete list of affected versions.

Vulnerability: The vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89), commonly known as SQL Injection. The FortiWeb appliance fails to properly sanitize user-supplied input before it is processed by a back-end database. An unauthenticated remote attacker can exploit this by sending a specially crafted request to a vulnerable component, allowing them to inject and execute malicious SQL queries. Successful exploitation could grant the attacker full control over the database, enabling them to read, modify, or delete data, and potentially escalate privileges to execute commands on the underlying operating system.

Business Impact

This vulnerability presents a critical risk to the organization, reflected by its CVSS score of 9.8. Exploitation could lead to a full compromise of the FortiWeb appliance, which is a key security device. Potential consequences include the exfiltration of sensitive data that the web application firewall is meant to protect, unauthorized modification of security policies, and using the compromised device as a pivot point to attack the internal network. A successful attack could result in significant data breaches, operational downtime, reputational damage, and potential regulatory penalties.

Remediation Plan

Immediate Action: Apply the security patches provided by Fortinet to all affected FortiWeb appliances immediately. Prioritize patching for internet-facing systems. After patching, review system and access logs for any signs of compromise that may have occurred before the update was applied.

Proactive Monitoring: Actively monitor web server logs, firewall logs, and FortiWeb appliance logs for suspicious activity. Look for requests containing SQL keywords (e.g., SELECT, UNION, INSERT, '--', OR 1=1), unusual error messages from the database, or unexpected traffic originating from the FortiWeb management interface. Configure alerts for multiple failed login attempts or access from untrusted IP addresses.

Compensating Controls: If patching cannot be performed immediately, restrict access to the FortiWeb management interface to a dedicated and secure management network. Limit access to only authorized personnel and trusted IP addresses. If possible, place an additional access control list (ACL) or firewall rule upstream to filter traffic to the management interface.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of Jul 17, 2025, there are no known public exploits available for this vulnerability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no widespread, active exploitation has been observed. However, given the critical CVSS score and the nature of the vulnerability, threat actors are likely to develop exploit code rapidly.

Analyst Recommendation

Given the critical severity (CVSS 9.8) of this vulnerability, we strongly recommend that immediate action is taken to mitigate the risk. The primary course of action is to apply the vendor-supplied patches to all affected Fortinet FortiWeb instances without delay. If immediate patching is not feasible, implement the recommended compensating controls, particularly restricting access to the management interface, as a matter of urgency. Organizations should remain vigilant and monitor for any updates from Fortinet or CISA regarding the exploitation status of this vulnerability.

Executive Summary:
A critical vulnerability has been discovered in multiple versions of the Fortinet FortiSIEM product, which could allow a remote, unauthenticated attacker to execute arbitrary commands on the system. This flaw, with a CVSS score of 9.8, represents a significant risk, as successful exploitation could lead to a complete compromise of the security appliance. This would enable an attacker to steal sensitive data, disrupt security monitoring, and pivot to other systems within the network.

Vulnerability Details

CVE-ID: CVE-2025-25256

Affected Software: Fortinet FortiSIEM

Affected Versions: 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.x. See vendor advisory for a complete list of affected versions.

Vulnerability: The vulnerability is an OS Command Injection (CWE-78) flaw. It exists because a component within the FortiSIEM application fails to properly sanitize user-supplied input before passing it to the underlying operating system for execution. An unauthenticated remote attacker can craft a malicious request containing special shell characters (e.g., ;, |, &&, $(...)) to a vulnerable endpoint. The application processes this input and executes the embedded commands with the privileges of the application's service account, which could be a high-privilege user, leading to remote code execution (RCE).

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.8, posing an extreme risk to the organization. As FortiSIEM is a central component of an organization's security infrastructure, its compromise has severe consequences. An attacker could achieve full control over the appliance, leading to the loss of confidentiality, integrity, and availability. Specific risks include the exfiltration of sensitive log data and credentials stored on the SIEM, complete disruption of security monitoring and alerting capabilities (blinding the security team), and using the compromised system as a pivot point to launch further attacks across the internal network.

Remediation Plan

Immediate Action: The primary remediation is to apply the vendor-supplied security patches. Administrators should immediately update all affected Fortinet FortiSIEM instances to the latest secure version as recommended in the official Fortinet security advisory. After patching, verify that the update was successful and the system is operating normally.

Proactive Monitoring: Organizations should actively monitor for signs of compromise. Review FortiSIEM application logs, web server access logs, and system-level command execution logs for any requests containing shell metacharacters or unusual command strings. Monitor network traffic for unexpected outbound connections from the FortiSIEM appliance, which could indicate a reverse shell or data exfiltration. Use endpoint detection and response (EDR) tools to look for anomalous process execution or file modifications on the appliance itself.

Compensating Controls: If patching cannot be performed immediately, implement compensating controls to reduce the risk. Restrict network access to the FortiSIEM management interface to a secure, isolated network segment or a limited set of trusted IP addresses using a firewall. If possible, deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block OS command injection attack patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 12, 2025, there are no known public exploits or active exploitation campaigns targeting this vulnerability. However, due to the critical severity (CVSS 9.8) and the relative simplicity of exploiting command injection flaws, it is highly likely that threat actors will develop and deploy exploits rapidly. Organizations should anticipate the release of proof-of-concept (PoC) code from security researchers in the near future.

Analyst Recommendation
Given the critical nature of this vulnerability, we strongly recommend that organizations treat its remediation as the highest priority. A compromised SIEM not only results in the loss of a critical security tool but also becomes a powerful platform for an attacker to launch further attacks. All affected FortiSIEM instances must be patched immediately. While this CVE is not currently on the CISA KEV list, its high impact score makes it a prime candidate for future inclusion. Therefore, it should be treated with the urgency of an actively exploited vulnerability. If immediate patching is not feasible, apply the recommended compensating controls and create a definitive plan to patch as soon as possible.