An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortin

Summary

An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 through 7.3.1, FortiSIEM 7.2.0 through 7.2.5, FortiSIEM 7.1.0 through 7.1.7, FortiSIEM 7.0.0 through 7.0.3, FortiSIEM 6.7.0 through 6.7.9, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions, FortiSIEM 6.4 all versions, FortiSIEM 6.3 all versions, FortiSIEM 6.2 all versions, FortiSIEM 6.1 all versions, FortiSIEM 5.4 all versions, FortiSIEM 5.3 all versions, FortiSIEM 5.2 all versions, FortiSIEM 5.1 all versions, FortiSIEM 5.0 all versions, FortiSIEM 4.10 all versions, FortiSIEM 4.9 all versions, FortiSIEM 4.7 all versions allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.

Timeline

1. Aug 12, 2025, 6:59 PM UTCCVE published
2. Aug 16, 2025, 3:55 AM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: yes · Technical impact: total

3. Aug 18, 2026, 9:09 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Fortinet FortiSIEM

  From 7.3.0 · through 7.3.1; From 7.2.0 · through 7.2.5; From 7.1.0 · through 7.1.7; From 7.0.0 · through 7.0.3; From 6.7.0 · through 6.7.9; From 6.6.0 · through 6.6.5; From 6.5.0 · through 6.5.3; From 6.4.0 · through 6.4.4; From 6.3.0 · through 6.3.3; From 6.2.0 · through 6.2.1; From 6.1.0 · through 6.1.2; From 5.3.0 · through 5.3.3; From 5.2.5 · through 5.2.8; From 5.2.1 · through 5.2.2; From 5.1.0 · through 5.1.3; From 5.0.0 · through 5.0.1

References 3