# Fortinet products vulnerable to arbitrary code execution

Published: 2026-02-10 · Severity: high · Sectors: government-national, defense, financial-services, healthcare, technology
Canonical: https://vorant.io/reports/e10d8b71-4dbf-5cfa-9cce-5b22c5dff0a6/fortinet-products-vulnerable-to-arbitrary-code-execution

> Multiple critical vulnerabilities in FortiAuthenticator, FortiClientEMS, FortiClient, FortiOS, and FortiSandbox allow unauthenticated attackers to execute arbitrary code; no active exploitation reported.

A CIS advisory identifies multiple vulnerabilities affecting several Fortinet product lines, with the most severe allowing arbitrary code execution in the context of affected service accounts. The primary attack vectors include SQL injection in FortiClientEMS (CVE-2026-21643), cross-site scripting in FortiSandbox (CVE-2025-52436), and LDAP authentication bypass in FortiOS fnbamd (CVE-2026-22153). Successful exploitation could allow attackers to install programs, modify or delete data, or create new accounts depending on service account privileges. Additional lower-severity issues include file write vulnerabilities in FortiClient Windows, authentication bypass in FSSO, format string flaws in FortiGate, missing authorization checks in FortiAuthenticator, HTTP request smuggling in FortiOS, and SSL-VPN information disclosure. According to the advisory, there are currently no reports of these vulnerabilities being exploited in the wild, but organizations should apply stable channel updates immediately to all affected systems.

## Mentioned in this report

- Vulnerabilities: CVE-2025-52436, CVE-2025-55018, CVE-2025-62439, CVE-2025-62676, CVE-2025-64157, CVE-2025-68686 (KEV), CVE-2026-21643 (KEV), CVE-2026-21743, CVE-2026-22153

## Detection guidance (public sample)

### Database Server Process Spawning Command Shell or Scripting Interpreter

ATT&CK: T1190

SQL Server or PostgreSQL service processes spawning cmd, PowerShell or LOLBins, a post-exploitation pattern for SQL injection to code execution on FortiClientEMS-style Windows hosts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Database Server Process Spawning Command Shell or Scripting Interpreter
description: Detects sqlservr.exe or postgres.exe spawning a command shell or scripting/LOLBin
  child. This is the typical post-exploitation pattern when SQL injection (for example
  in FortiClientEMS) is escalated to OS command execution via xp_cmdshell or COPY
  PROGRAM. Generalised on the parent/child relationship, not on any specific CVE payload.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \sqlservr.exe
    - \postgres.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \wscript.exe
    - \cscript.exe
    - \curl.exe
  filter_postgres_cmd_housekeeping:
    ParentImage|endswith: \postgres.exe
    Image|endswith: \cmd.exe
    CommandLine|contains:
    - pg_dump
    - pg_basebackup
    - archive_command
  condition: selection and not filter_postgres_cmd_housekeeping
falsepositives:
- DBA maintenance jobs that intentionally use xp_cmdshell for backups or file handling
- PostgreSQL archive_command or backup scripts invoking cmd.exe
level: high
id: ed518363-b223-52e4-81c5-7012582b7b38
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-012
```

### FortiClient EMS Component Spawning Shell or Download Utility

ATT&CK: T1190

Processes running from a Fortinet FortiClientEMS install path spawning cmd, PowerShell or download LOLBins, indicating possible exploitation of the EMS server. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FortiClient EMS Component Spawning Shell or Download Utility
description: Detects a process launched from a FortiClientEMS installation directory
  (web, application or bundled database services) spawning a shell, scripting host
  or download utility. Successful exploitation of EMS vulnerabilities such as SQL
  injection could yield arbitrary code execution in the service account context.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: \FortiClientEMS\
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \curl.exe
    - \net.exe
    - \net1.exe
    - \whoami.exe
  condition: selection_parent and selection_child
falsepositives:
- FortiClient EMS installer, upgrade or maintenance scripts that invoke cmd.exe or
  PowerShell
- Administrator-run diagnostic scripts launched from within the EMS directory
level: medium
id: 987dfede-ac5f-5131-913f-38df7ca2399e
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-012
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2026-012

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e10d8b71-4dbf-5cfa-9cce-5b22c5dff0a6/fortinet-products-vulnerable-to-arbitrary-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup