# Fortinet RCE flaws span FortiOS to FortiAnalyzer

Published: 2026-06-09 · Severity: elevated · Sectors: government-national, financial-services, defense, healthcare, infrastructure, energy
Canonical: https://vorant.io/reports/ce91280c-c5d4-5011-b744-f03dd8f6a659/fortinet-rce-flaws-span-fortios-to-fortianalyzer

> Multiple remote code execution vulnerabilities in Fortinet products; no active exploitation reported yet.

The MS-ISAC has published advisory 2025-040 documenting multiple vulnerabilities across Fortinet's product portfolio, ranging from remote code execution to privilege escalation and authentication bypass. The most critical vulnerabilities affect FortiOS, FortiManager, FortiAnalyzer, FortiProxy, FortiWeb, FortiIsolator, FortiSwitch, FortiVoice, FortiClient EMS, and FortiSwitch Manager. The primary RCE vector is an improper restriction of communication channels (CVE-2024-26013, CVE-2024-50565) allowing unauthenticated attackers in a man-in-the-middle position to impersonate management devices and intercept FGFM authentication between management and managed devices. Additional severe issues include OS command injection in FortiIsolator (CVE-2024-54024, CVE-2024-54025) requiring privileged access, and an unverified password change flaw in FortiSwitch GUI (CVE-2024-48887) permitting unauthenticated remote modification of admin credentials. Lesser-severity vulnerabilities include log pollution, credential theft via LDAP manipulation, cross-site scripting, path traversal, and memory corruption. Fortinet has not reported any in-the-wild exploitation of these flaws as of the advisory date. Successful exploitation of RCE vectors could grant attackers code execution in the context of the affected service account, potentially enabling data theft, system compromise, or account creation depending on service account privileges.

## Mentioned in this report

- Vulnerabilities: CVE-2023-37930, CVE-2024-26013, CVE-2024-32122, CVE-2024-46671, CVE-2024-48887, CVE-2024-50565, CVE-2024-52962, CVE-2024-54024, CVE-2024-54025, CVE-2025-22855, CVE-2025-25254

## Detection guidance (public sample)

### Inbound FGFM (TCP 541) Connection From Non-Internal Address

ATT&CK: T1190

Detects FortiGate-to-FortiManager (FGFM) management channel traffic on TCP/541 from public source addresses, which should not occur when management is kept internal; relevant to FGFM impersonation/auth-interception flaws (CVE-2024-26013, CVE-2024-50565). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Inbound FGFM (TCP 541) Connection From Non-Internal Address
description: Detects traffic to TCP port 541 (FGFM, the Fortinet management-to-managed
  device channel) originating from public IP space. The FGFM channel is exposed to
  impersonation and authentication interception flaws (CVE-2024-26013, CVE-2024-50565),
  and should normally only be seen between internal management and managed devices
  or known remote sites. Tune by allow-listing known remote FortiGate/FortiManager
  peers.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: firewall
detection:
  selection:
    dst_port: 541
  filter_internal:
    src_ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
  condition: selection and not filter_internal
falsepositives:
- Legitimate remote branch FortiGate devices managed by a central FortiManager across
  the internet
- Managed service providers administering customer Fortinet devices from public addresses
level: medium
id: e738dde8-54f3-5d69-b2db-a1d028813e1e
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-remote-code-execution_2025-040
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-remote-code-execution_2025-040

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ce91280c-c5d4-5011-b744-f03dd8f6a659/fortinet-rce-flaws-span-fortios-to-fortianalyzer.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup