# Multiple Fortinet products vulnerable to remote code execution

Published: 2026-01-13 · Severity: high · Sectors: Government (National), Financial Services, Technology, Healthcare
Canonical: https://vorant.io/reports/cc8fbdab-4d79-5a88-af93-2110b852c80b/multiple-fortinet-products-vulnerable-to-remote-code-execution
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> Multiple Fortinet products including FortiOS and FortiSIEM have critical remote code execution vulnerabilities; no active exploitation reported yet.

Source: cisecurity.org — https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-003

## What to check

- Applies to: The 6 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2025-25249 as exploited in the wild.

MS-ISAC has disclosed multiple vulnerabilities across Fortinet's product portfolio, with the most critical being two remote code execution flaws. CVE-2025-25249 is a heap-based buffer overflow in the cw_acd daemon affecting FortiOS and FortiSwitchManager, exploitable remotely without authentication. CVE-2025-64155 is an OS command injection in FortiSIEM allowing unauthenticated attackers to execute arbitrary commands via crafted TCP requests. Successful exploitation could allow arbitrary code execution in the context of the affected service account, potentially enabling program installation, data modification, or account creation depending on service account privileges.

Additional lower-severity vulnerabilities include path traversal in FortiVoice, SQL injection in FortiClientEMS, SSRF in FortiSandbox, and information disclosure in FortiFone. The advisory affects numerous products and versions across FortiOS, FortiSASE, FortiSIEM, FortiClientEMS, FortiSwitchManager, FortiSandbox, FortiFone, and FortiVoice. The vendor reports no current wild exploitation, but defenders using these products should prioritize testing and applying stable-channel updates immediately, with particular attention to external-facing systems running FortiOS or FortiSIEM.

## Mentioned in this report

- Vulnerabilities: CVE-2025-25249 (KEV), CVE-2025-47855, CVE-2025-58693, CVE-2025-59922, CVE-2025-64155, CVE-2025-67685

## Detection guidance (public sample)

### SQL Server Service Spawning Command Shell or LOLBin

ATT&CK: T1190

A behavioural hunt for the technique in general, not a signature for the CVEs this report names. Needs windows process_creation logs. Status: experimental. Generated from the report; not run against telemetry.

sqlservr.exe spawning cmd/PowerShell or common download and recon utilities, consistent with SQL injection to OS command execution on a Windows SQL back end such as FortiClientEMS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SQL Server Service Spawning Command Shell or LOLBin
description: Detects sqlservr.exe spawning cmd.exe, PowerShell or common download/recon
  utilities. This is typical of SQL injection escalating to OS command execution (for
  example via xp_cmdshell) on a Windows SQL back end such as the one used by FortiClientEMS
  (SQL injection in the advisory).
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \sqlservr.exe
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \cmd.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \whoami.exe
    - \mshta.exe
    - \curl.exe
  filter_sql_agent_maintenance:
    CommandLine|contains:
    - SQLAGENT
    - sqlcmd
  condition: selection and not filter_sql_agent_maintenance
falsepositives:
- Legitimate database administrators or jobs using xp_cmdshell for maintenance or
  backup scripts
- Vendor application installers that run shell commands through SQL Server
level: high
id: 47243dda-7195-5c3b-bcb5-90dbe363848f
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-003
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-003

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/cc8fbdab-4d79-5a88-af93-2110b852c80b/multiple-fortinet-products-vulnerable-to-remote-code-execution.
In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup