# Fortinet products allow arbitrary code execution via multiple flaws

Published: 2026-06-09 · Severity: high · Sectors: government-national, financial-services, technology, healthcare, education, manufacturing, transportation, telecommunications, defense, infrastructure
Canonical: https://vorant.io/reports/ff49fd41-a354-5f6b-a4a2-e01af30b707b/fortinet-products-allow-arbitrary-code-execution-via-multiple-flaws

> Multiple critical code-execution vulnerabilities in Fortinet endpoint, network, and security products; CVE-2025-58034 actively exploited in the wild.

Fortinet has disclosed multiple vulnerabilities across ten product lines—FortiClient, FortiExtender, FortiMail, FortiPAM, FortiSandbox, FortiADC, FortiWeb, FortiVoice, FortiOS, and FortiProxy—with the most severe allowing arbitrary code execution in the context of affected service accounts. CVE-2025-58034, a command-injection flaw in FortiWeb, has already been exploited in the wild and allows authenticated attackers to execute unauthorized code. Additional critical flaws include stack-based overflows in FortiOS CAPWAP (CVE-2025-58431), heap and buffer overflows in FortiClient (CVE-2025-46373, CVE-2025-47761), and command-injection in FortiExtender (CVE-2025-46776). Privilege escalation depends on the service account's rights; those with administrative access pose the greatest risk. Lower-severity issues include credential exposure, header injection, and debug-code leakage across the product portfolio.

## Mentioned in this report

- Vulnerabilities: CVE-2025-46215, CVE-2025-46373, CVE-2025-46775, CVE-2025-46776, CVE-2025-47761, CVE-2025-48839, CVE-2025-53843, CVE-2025-54660, CVE-2025-54821, CVE-2025-54971, CVE-2025-54972, CVE-2025-58034 (KEV), CVE-2025-58412, CVE-2025-58431, CVE-2025-58692, CVE-2025-59669, CVE-2025-61713

## Detection guidance (public sample)

### Command Injection Metacharacters with Download or Shell Commands in Web Request Query

ATT&CK: T1190

Detects web requests to public-facing appliances or web apps whose query string carries shell command-substitution or chaining syntax plus a downloader or shell, typical of command-injection exploitation such as the FortiWeb and FortiExtender flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Command Injection Metacharacters with Download or Shell Commands in Web Request
  Query
description: Detects web requests whose query string contains shell command substitution
  or chaining followed by a downloader or shell binary. Generalises on command-injection
  exploitation of public-facing devices (e.g. Fortinet FortiWeb/FortiExtender command-injection
  flaws), not on a specific URL path. Tune by web server log source; thresholds on
  repetition should be applied in the SIEM.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains:
    - '`curl '
    - '`wget '
    - '$(curl '
    - '$(wget '
    - ';curl '
    - ';wget '
    - '|/bin/sh'
    - '|/bin/bash'
    - '%60curl'
    - '%60wget'
    - '%24%28curl'
    - '%24%28wget'
    - '%3Bcurl'
    - '%3Bwget'
    - '%7C/bin/sh'
    - '%7C/bin/bash'
  condition: selection
falsepositives:
- Security scanners or penetration tests run against the web server
- Developer documentation or code-sharing sites that legitimately carry shell snippets
  in query strings
level: medium
id: 9ce8b7fe-2053-5f6e-a009-110a555757f2
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2025-108
```

### Web Server Process Spawning Shell with Download or Reverse-Shell Arguments

ATT&CK: T1059.004

Detects a Linux web server or CGI process spawning a shell that runs download, reverse-shell or decode-and-execute commands, indicating post-exploitation of a command-injection flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Spawning Shell with Download or Reverse-Shell Arguments
description: Detects web server processes (nginx, apache, httpd, lighttpd, php-fpm)
  spawning sh/bash with downloader, netcat, /dev/tcp or base64-decode arguments. Generalises
  on the parent/child relation seen when command-injection flaws in public-facing
  appliances or web apps are exploited.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
    - /nginx
    - /apache2
    - /httpd
    - /lighttpd
    - /php-fpm
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
  selection_cmd:
    CommandLine|contains:
    - curl
    - wget
    - /dev/tcp/
    - nc -e
    - base64 -d
    - chmod +x
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
- Legacy CGI scripts that shell out to curl or wget for legitimate integrations
- Web-based admin panels that run update or download scripts
level: high
id: 15a698f5-e9c0-54f7-8b7e-4ed7527cee04
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2025-108
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-arbitrary-code-execution_2025-108

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ff49fd41-a354-5f6b-a4a2-e01af30b707b/fortinet-products-allow-arbitrary-code-execution-via-multiple-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup