Fortinet Archives - Recon Bee

Fortinet Patches Critical SQLi Flaw Enabling Unauthenticated Code Execution

10Feb

By RBNo Comments

News

Fortinet Patches Critical SQLi Flaw Enabling Unauthenticated Code Execution

To fix a serious vulnerability in FortiClientEMS that might let arbitrary code to run on vulnerable systems, Fortinet has published security upgrades. Tracked as CVE-2026-21643, the vulnerability has a CVSS rating of 9.1 out of 10.0. According to a Fortinet advisory, an unauthenticated attacker may be able to execute unauthorized code or commands via specially constructed HTTP requests due to an incorrect neutralization of special elements used in a SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiClientEMS. The shortcoming affects the following versions - FortiClientEMS 7.2 (Not affected) FortiClientEMS 7.4.4 (Upgrade to 7.4.5 or above) FortiClientEMS 8.0 (Not affected) Fortinet Product Security team member Gwendal Guégniaud is credited with identifying...

Hackers now exploiting critical Fortinet FortiSIEM flaw in attacks

16Jan

By RBNo Comments

News

Hackers now exploiting critical Fortinet FortiSIEM flaw in attacks

Attacks are currently abusing a major Fortinet FortiSIEM vulnerability that has proof-of-concept exploit code available to the public. The vulnerability (CVE-2025-64155) is a mix of two problems that permit arbitrary writing with admin rights and privilege escalation to root access, according to security researcher Zach Hanley of penetration testing firm Horizon3.ai. When Fortinet released security updates to fix the vulnerability on Tuesday, it explained that an unauthenticated attacker could execute unauthorized code or commands via crafted TCP requests due to an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiSIEM. Horizon3.ai posted proof-of-concept exploit code and a technical article outlining how the...

Fortinet Warns of New FortiWeb CVE-2025-58034 Vulnerability Exploited in the Wild

19Nov

By RBNo Comments

News

Fortinet Warns of New FortiWeb CVE-2025-58034 Vulnerability Exploited in the Wild

A new security vulnerability in FortiWeb has been reported to have been exploited in the wild, according to Fortinet. Tracked as CVE-2025-58034, the medium-severity vulnerability has a CVSS score of 6.7 out of a possible 10.0. According to a Tuesday advisory from the company, an authenticated attacker may be able to execute unauthorized code on the underlying system through crafted HTTP requests or CLI commands due to an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] in FortiWeb. To put it another way, in order for an attack to be effective, the attacker must first identify himself using another method before chaining it with CVE-2025-58034 to carry out arbitrary operating system operations. It has been address...

Fortinet discloses second firewall auth bypass patched in January

12Feb

By RBNo Comments

News

Fortinet discloses second firewall auth bypass patched in January

Updated @ 07:32 PM ET on 2/11/25: Fortinet has notified us that the new CVE-2025-24472 vulnerability that was added to FG-IR-24-535 today is not a zero-day and was already addressed in January, following the publication of our story. Additionally, Fortinet claims that only CVE-2024-55591 was exploited, despite the fact that today's updated warning shows that both vulnerabilities were used in attacks and even provides a fix for the new CSF proxy requests exploitation pathway. Fortinet informed BleepingComputer that customers are already protected against the recently revealed vulnerability if they have upgraded in accordance with the instructions read more about Fortinet discloses second firewall auth bypass patched in January. Get up to date on the latest cybersecurity news and e...

Fortinet Warns of Critical Vulnerability in FortiManager Under Active Exploitation

24Oct

By RBNo Comments

News

Fortinet Warns of Critical Vulnerability in FortiManager Under Active Exploitation

Details of a serious security vulnerability affecting FortiManager that has been actively exploited in the wild have been verified by Fortinet. The vulnerability, also known as FortiJump, is rooted in the FortiGate to FortiManager (FGFM) protocol and is tracked as CVE-2024-47575 (CVSS score: 9.8). According to the company's statement on Wednesday, a remote, unauthenticated attacker might use specifically constructed requests to execute arbitrary code or commands due to a critical function vulnerability [CWE-306] in the FortiManager fgfmd daemon that lacks authentication. FortiManager versions 7.x, 6.x, and FortiManager Cloud 7.x and 6.x are affected by the flaw. It impacts older FortiAnalyzer models as well read more about Fortinet Warns of Critical Vulnerability in FortiManager ...

UNC3886 Uses Fortinet, VMware 0-Days and Stealth Tactics in Long-Term Spying

20Jun

By RBNo Comments

News

UNC3886 Uses Fortinet, VMware 0-Days and Stealth Tactics in Long-Term Spying

Multiple persistence strategies have been seen to be used by the China-nexus cyber espionage actor connected to the zero-day exploitation of security weaknesses in Fortinet, Ivanti, and VMware devices to keep unrestricted access to compromised environments. According to a recent analysis from Mandiant researchers, persistence techniques included network devices, hypervisors, and virtual machines and made sure that alternate channels remained accessible even in the event that the primary layer was identified and removed. UNC3886 is the threat actor in question, and the threat intelligence firm controlled by Google described it as "sophisticated, cautious, and evasive." The adversary's attacks have taken advantage of zero-day vulnerabilities including CVE-2022-41328 (Fortinet Forti...

Fortinet warns of critical command injection bug in FortiSIEM

17Nov

By RBNo Comments

News

Fortinet warns of critical command injection bug in FortiSIEM

Customers should be aware that Fortinet has discovered a serious OS command injection vulnerability in the FortiSIEM report server. This vulnerability could allow remote, unauthenticated attackers to execute commands by sending carefully constructed API requests. A comprehensive cybersecurity solution called FortiSIEM (Security Information and Event Management) gives businesses more visibility and precise control over their security posture. It is utilized by companies of all sizes in the public, healthcare, financial, retail, e-commerce, and government domains.The vulnerability was identified earlier this week by Fortinet's product security team read more Fortinet warns of critical command injection bug in FortiSIEM. Get up to date on the latest cybersecurity news and enhance yo...