Fortinet RCE flaws span FortiOS to FortiAnalyzer
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple remote code execution vulnerabilities in Fortinet products; no active exploitation reported yet.
The MS-ISAC has published advisory 2025-040 documenting multiple vulnerabilities across Fortinet's product portfolio, ranging from remote code execution to privilege escalation and authentication bypass. The most critical vulnerabilities affect FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb, FortiIsolator, FortiSwitch, FortiVoice, FortiClient EMS, and FortiSwitch Manager. The primary RCE vector is an improper restriction of communication channels (CVE-2024-26013, CVE-2024-50565) allowing unauthenticated attackers in a man-in-the-middle position to impersonate management devices and intercept FGFM authentication between management and managed devices. Additional severe issues include OS command injection in FortiIsolator (CVE-2024-54024, CVE-2024-54025) requiring privileged access, and an unverified password change flaw in FortiSwitch GUI (CVE-2024-48887) permitting unauthenticated remote modification of admin credentials. Lesser-severity vulnerabilities include log pollution, credential theft via LDAP manipulation, cross-site scripting, path traversal, and memory corruption. Fortinet has not reported any in-the-wild exploitation of these flaws as of the advisory date. Successful exploitation of RCE vectors could grant attackers code execution in the context of the affected service account, potentially enabling data theft, system compromise, or account creation depending on service account privileges.
Mentioned in this report
Detection guidance
Inbound FGFM (TCP 541) Connection From Non-Internal Address
Detects FortiGate-to-FortiManager (FGFM) management channel traffic on TCP/541 from public source addresses, which should not occur when management is kept internal; relevant to FGFM impersonation/auth-interception flaws (CVE-2024-26013, CVE-2024-50565). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Inbound FGFM (TCP 541) Connection From Non-Internal Address
description: Detects traffic to TCP port 541 (FGFM, the Fortinet management-to-managed
device channel) originating from public IP space. The FGFM channel is exposed to
impersonation and authentication interception flaws (CVE-2024-26013, CVE-2024-50565),
and should normally only be seen between internal management and managed devices
or known remote sites. Tune by allow-listing known remote FortiGate/FortiManager
peers.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: firewall
detection:
selection:
dst_port: 541
filter_internal:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
condition: selection and not filter_internal
falsepositives:
- Legitimate remote branch FortiGate devices managed by a central FortiManager across
the internet
- Managed service providers administering customer Fortinet devices from public addresses
level: medium
id: e738dde8-54f3-5d69-b2db-a1d028813e1e
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-remote-code-execution_2025-040
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-remote-code-execution_2025-040
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs