Fortinet products allow arbitrary code execution via multiple flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple critical code-execution vulnerabilities in Fortinet endpoint, network, and security products; CVE-2025-58034 actively exploited in the wild.
Fortinet has disclosed multiple vulnerabilities across ten product lines—FortiClient, FortiExtender, FortiMail, FortiPAM, FortiSandbox, FortiADC, FortiWeb, FortiVoice, FortiOS, and FortiProxy—with the most severe allowing arbitrary code execution in the context of affected service accounts. CVE-2025-58034, a command-injection flaw in FortiWeb, has already been exploited in the wild and allows authenticated attackers to execute unauthorized code. Additional critical flaws include stack-based overflows in FortiOS CAPWAP (CVE-2025-58431), heap and buffer overflows in FortiClient (CVE-2025-46373, CVE-2025-47761), and command-injection in FortiExtender (CVE-2025-46776). Privilege escalation depends on the service account's rights; those with administrative access pose the greatest risk. Lower-severity issues include credential exposure, header injection, and debug-code leakage across the product portfolio.
Mentioned in this report
Detection guidance
Command Injection Metacharacters with Download or Shell Commands in Web Request Query
Detects web requests to public-facing appliances or web apps whose query string carries shell command-substitution or chaining syntax plus a downloader or shell, typical of command-injection exploitation such as the FortiWeb and FortiExtender flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Injection Metacharacters with Download or Shell Commands in Web Request
Query
description: Detects web requests whose query string contains shell command substitution
or chaining followed by a downloader or shell binary. Generalises on command-injection
exploitation of public-facing devices (e.g. Fortinet FortiWeb/FortiExtender command-injection
flaws), not on a specific URL path. Tune by web server log source; thresholds on
repetition should be applied in the SIEM.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- '`curl '
- '`wget '
- '$(curl '
- '$(wget '
- ';curl '
- ';wget '
- '|/bin/sh'
- '|/bin/bash'
- '%60curl'
- '%60wget'
- '%24%28curl'
- '%24%28wget'
- '%3Bcurl'
- '%3Bwget'
- '%7C/bin/sh'
- '%7C/bin/bash'
condition: selection
falsepositives:
- Security scanners or penetration tests run against the web server
- Developer documentation or code-sharing sites that legitimately carry shell snippets
in query strings
level: medium
id: 9ce8b7fe-2053-5f6e-a009-110a555757f2
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2025-108
Web Server Process Spawning Shell with Download or Reverse-Shell Arguments
Detects a Linux web server or CGI process spawning a shell that runs download, reverse-shell or decode-and-execute commands, indicating post-exploitation of a command-injection flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell with Download or Reverse-Shell Arguments
description: Detects web server processes (nginx, apache, httpd, lighttpd, php-fpm)
spawning sh/bash with downloader, netcat, /dev/tcp or base64-decode arguments. Generalises
on the parent/child relation seen when command-injection flaws in public-facing
appliances or web apps are exploited.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /nginx
- /apache2
- /httpd
- /lighttpd
- /php-fpm
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
selection_cmd:
CommandLine|contains:
- curl
- wget
- /dev/tcp/
- nc -e
- base64 -d
- chmod +x
condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Legacy CGI scripts that shell out to curl or wget for legitimate integrations
- Web-based admin panels that run update or download scripts
level: high
id: 15a698f5-e9c0-54f7-8b7e-4ed7527cee04
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2025-108
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2025-108
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs