Multiple Fortinet products vulnerable to remote code execution
Multiple Fortinet products including FortiOS and FortiSIEM have critical remote code execution vulnerabilities; no active exploitation reported yet.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 6 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-25249 as exploited in the wild.
MS-ISAC has disclosed multiple vulnerabilities across Fortinet's product portfolio, with the most critical being two remote code execution flaws. CVE-2025-25249 is a heap-based buffer overflow in the cw_acd daemon affecting FortiOS and FortiSwitchManager, exploitable remotely without authentication. CVE-2025-64155 is an OS command injection in FortiSIEM allowing unauthenticated attackers to execute arbitrary commands via crafted TCP requests. Successful exploitation could allow arbitrary code execution in the context of the affected service account, potentially enabling program installation, data modification, or account creation depending on service account privileges.
Additional lower-severity vulnerabilities include path traversal in FortiVoice, SQL injection in FortiClientEMS, SSRF in FortiSandbox, and information disclosure in FortiFone. The advisory affects numerous products and versions across FortiOS, FortiSASE, FortiSIEM, FortiClientEMS, FortiSwitchManager, FortiSandbox, FortiFone, and FortiVoice. The vendor reports no current wild exploitation, but defenders using these products should prioritize testing and applying stable-channel updates immediately, with particular attention to external-facing systems running FortiOS or FortiSIEM.
Mentioned in this report
Detection guidance
SQL Server Service Spawning Command Shell or LOLBin
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
sqlservr.exe spawning cmd/PowerShell or common download and recon utilities, consistent with SQL injection to OS command execution on a Windows SQL back end such as FortiClientEMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SQL Server Service Spawning Command Shell or LOLBin
description: Detects sqlservr.exe spawning cmd.exe, PowerShell or common download/recon
utilities. This is typical of SQL injection escalating to OS command execution (for
example via xp_cmdshell) on a Windows SQL back end such as the one used by FortiClientEMS
(SQL injection in the advisory).
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \sqlservr.exe
Image|endswith:
- \powershell.exe
- \pwsh.exe
- \cmd.exe
- \certutil.exe
- \bitsadmin.exe
- \whoami.exe
- \mshta.exe
- \curl.exe
filter_sql_agent_maintenance:
CommandLine|contains:
- SQLAGENT
- sqlcmd
condition: selection and not filter_sql_agent_maintenance
falsepositives:
- Legitimate database administrators or jobs using xp_cmdshell for maintenance or
backup scripts
- Vendor application installers that run shell commands through SQL Server
level: high
id: 47243dda-7195-5c3b-bcb5-90dbe363848f
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-003
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-003
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs