Fortinet patches critical RCE flaws across product portfolio
Multiple vulnerabilities in Fortinet's enterprise security products could allow remote code execution, though no active exploitation has been reported.
Fortinet has disclosed multiple vulnerabilities affecting a broad range of its enterprise security and management products, including FortiOS, FortiManager, FortiProxy, FortiAnalyzer, FortiSandbox, and others. The most severe vulnerabilities could enable remote code execution when successfully exploited, allowing attackers to install programs, manipulate data, or create new accounts depending on the privileges of the affected service account.
The vulnerabilities span several attack vectors, including OS command injection flaws in FortiIsolator and FortiSandbox, format string vulnerabilities in FortiOS and FortiProxy, CSRF issues in FortiNDR, and SQL injection flaws in FortiAnalyzer and FortiManager. Several issues require authenticated access with administrative privileges, while others like the FortiNDR CSRF vulnerability can be exploited by unauthenticated attackers. Additional lower-severity vulnerabilities include path traversal in FortiWeb, authorization bypasses in FortiSIEM, and XSS issues in FortiADC.
No active exploitation has been reported in the wild. MS-ISAC has issued this advisory with a high-risk rating for government and business environments, recommending immediate patching after testing, implementation of least-privilege principles, network segmentation, and regular vulnerability scanning. The extensive list of affected versions spans multiple major and minor releases across Fortinet's product line, potentially impacting organizations relying on these platforms for security operations, network management, and threat detection.
Mentioned in this report
Detection guidance
Suspicious Shell Spawned by Network/Security Appliance Service Process
Detects a shell or command interpreter spawned as a child of a web/management service process, consistent with OS command injection exploitation of an exposed appliance service (e.g., FortiIsolator, FortiSandbox style flaws). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned by Web or Management Daemon Process
id: 16071726-1142-5366-a247-3a3d518ed02d
status: experimental
description: 'Detects command interpreters (sh, bash, dash) being spawned directly
by a web server, management API, or appliance service daemon process. This pattern
is consistent with exploitation of OS command injection vulnerabilities such as
those disclosed in Fortinet FortiIsolator and FortiSandbox, where an unauthenticated
or authenticated request triggers execution of attacker-supplied shell commands
on the underlying service.
'
references:
- Fortinet critical RCE advisory - MS-ISAC
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- /httpd
- /nginx
- /cmdb
- /forticron
- /websh
- management
- wad
Image|endswith:
- /sh
- /bash
- /dash
filter:
CommandLine|contains:
- logrotate
- cron.daily
- healthcheck
condition: selection and not filter
falsepositives:
- Legitimate service health-check or scheduled maintenance scripts spawned by the
web/management daemon
- Vendor-provided support scripts that legitimately shell out from the management
interface
level: medium
Command Interpreter Invoked with Injection-Style Metacharacters via Network Service
Detects command-line arguments containing shell metacharacter sequences typical of OS command injection payloads, executed by a process associated with an exposed management or security appliance service, indicating exploitation of an unauthenticated or authenticated RCE flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Injection Metacharacters in Process Launched by Appliance Service
id: 24d58ebd-4ba9-50e6-a6c8-2643179effc6
status: experimental
description: 'Detects execution of command interpreters with command-line content
containing shell metacharacters commonly used to chain or inject commands (e.g.
; , | , && , $( ) ) when the parent process is a web-facing or management service.
This behaviour is consistent with exploitation of OS command injection vulnerabilities
disclosed across Fortinet products (FortiIsolator, FortiSandbox) reachable via an
exposed management interface.
'
references:
- Fortinet critical RCE advisory - MS-ISAC
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- /httpd
- /nginx
- /cmdb
- management
- wad
CommandLine|contains:
- ;
- '&&'
- $(
- '`'
- '|'
filter:
CommandLine|contains:
- logrotate
- --help
condition: selection and not filter
falsepositives:
- Administrative scripts or plugins that legitimately chain shell commands from the
management daemon
- Vendor diagnostic tooling that pipes output between built-in utilities
level: medium
New Local Administrative Account Created Shortly After Appliance Authentication
Detects creation of a new privileged local account on a security appliance or management platform immediately following an authenticated session, which may indicate abuse of valid credentials or an authenticated RCE/SQLi flaw to persist access (e.g. FortiAnalyzer/FortiManager SQL injection issues). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: New Admin Account Created via Management Interface After Authentication
id: d3227c38-4d70-59c6-96c1-55555666e0d9
status: experimental
description: 'Detects creation of a new account with administrative privileges through
a management daemon shortly after a login event, on appliance-style platforms. This
pattern can indicate abuse of valid accounts or exploitation of an authenticated
remote code execution / SQL injection vulnerability (as seen in FortiAnalyzer and
FortiManager) to create a persistent administrative account.
'
references:
- Fortinet critical RCE advisory - MS-ISAC
author: Vorant
tags:
- attack.t1078
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- /cmdb
- management
- /httpd
CommandLine|contains:
- useradd
- adduser
- set admin
- config system admin
filter:
CommandLine|contains:
- ansible
- puppet
- chef-client
condition: selection and not filter
falsepositives:
- Legitimate administrator onboarding performed through the management console or
configuration management tooling
- Automated provisioning scripts that create service accounts during deployment
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-remote-code-execution_2025-021
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free