AI analysis
Claude Opus · 7 Nov 2026, 10:20 CET
Fortinet FortiOS, FortiProxy and related products allow admin file writes via CLI
An authenticated Fortinet administrator with read-write rights can write or delete arbitrary files through specific CLI commands. CISA lists the flaw as exploited. Review Fortinet's advisory, apply its mitigations or updates, and audit admin accounts now.
In plain terms
Several Fortinet security products have a flaw in their command-line interface (CLI), the text console administrators use to manage the device. Affected products include the FortiOS firewall operating system, FortiProxy, FortiPAM and FortiSwitchManager. The flaw is a path traversal, meaning the software does not properly restrict which folders a file operation can reach. Someone already logged in as an administrator with read-write permissions could create, overwrite or delete files anywhere on the device, not just in the locations those commands are meant to touch.
This matters because these devices usually sit at the edge of a network and protect everything behind it. An attacker who has stolen or abused an admin login could use the flaw to tamper with the device or disable it. CISA has confirmed real-world exploitation. Anyone running the affected Fortinet products, or the Siemens RUGGEDCOM APE1808 that NVD also lists, should treat this as a priority.