Fortinet products vulnerable to arbitrary code execution

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Multiple critical vulnerabilities in FortiAuthenticator, FortiClientEMS, FortiClient, FortiOS, and FortiSandbox allow unauthenticated attackers to execute arbitrary code; no active exploitation reported.

A CIS advisory identifies multiple vulnerabilities affecting several Fortinet product lines, with the most severe allowing arbitrary code execution in the context of affected service accounts. The primary attack vectors include SQL injection in FortiClientEMS (CVE-2026-21643), cross-site scripting in FortiSandbox (CVE-2025-52436), and LDAP authentication bypass in FortiOS fnbamd (CVE-2026-22153). Successful exploitation could allow attackers to install programs, modify or delete data, or create new accounts depending on service account privileges. Additional lower-severity issues include file write vulnerabilities in FortiClient Windows, authentication bypass in FSSO, format string flaws in FortiGate, missing authorization checks in FortiAuthenticator, HTTP request smuggling in FortiOS, and SSL-VPN information disclosure. According to the advisory, there are currently no reports of these vulnerabilities being exploited in the wild, but organizations should apply stable channel updates immediately to all affected systems.

title: Database Server Process Spawning Command Shell or Scripting Interpreter
description: Detects sqlservr.exe or postgres.exe spawning a command shell or scripting/LOLBin
  child. This is the typical post-exploitation pattern when SQL injection (for example
  in FortiClientEMS) is escalated to OS command execution via xp_cmdshell or COPY
  PROGRAM. Generalised on the parent/child relationship, not on any specific CVE payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \sqlservr.exe
    - \postgres.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \wscript.exe
    - \cscript.exe
    - \curl.exe
  filter_postgres_cmd_housekeeping:
    ParentImage|endswith: \postgres.exe
    Image|endswith: \cmd.exe
    CommandLine|contains:
    - pg_dump
    - pg_basebackup
    - archive_command
  condition: selection and not filter_postgres_cmd_housekeeping
falsepositives:
- DBA maintenance jobs that intentionally use xp_cmdshell for backups or file handling
- PostgreSQL archive_command or backup scripts invoking cmd.exe
level: high
id: ed518363-b223-52e4-81c5-7012582b7b38
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-012

title: FortiClient EMS Component Spawning Shell or Download Utility
description: Detects a process launched from a FortiClientEMS installation directory
  (web, application or bundled database services) spawning a shell, scripting host
  or download utility. Successful exploitation of EMS vulnerabilities such as SQL
  injection could yield arbitrary code execution in the service account context.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: \FortiClientEMS\
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \curl.exe
    - \net.exe
    - \net1.exe
    - \whoami.exe
  condition: selection_parent and selection_child
falsepositives:
- FortiClient EMS installer, upgrade or maintenance scripts that invoke cmd.exe or
  PowerShell
- Administrator-run diagnostic scripts launched from within the EMS directory
level: medium
id: 987dfede-ac5f-5131-913f-38df7ca2399e
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-012

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-012