CVE-2021-44168

LOW3.3

CISA KEV

Published 2022-01-04 · Updated 2026-06-17 · Source psirt@fortinet.com

Summary

CVE-2021-44168 is a low-severity (CVSS 3.3) vulnerability in Fortinet FortiOS. CISA added it to the Known Exploited Vulnerabilities catalog on December 10, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by December 24, 2021. CISA does not currently list it as used in ransomware campaigns. Fortinet has 32 vulnerabilities in the KEV catalog, 14 of them linked to ransomware.

All 32 known-exploited Fortinet vulnerabilities →

Description

A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE-494CWE-494

CISA Known-Exploited Vulnerability

Product: Fortinet — FortiOS

Name: Fortinet FortiOS Arbitrary File Download

Date added: 2021-12-10 · Due: 2021-12-24

Required action: Apply updates per vendor instructions.

References

View on NVD

More exploited Fortinet vulnerabilities

Most recently added to CISA KEV

CVE-2025-61624
Multiple Products — Fortinet Multiple Products Path Traversal Vulnerability
added 2026-10-16
CVE-2026-104286
FortiMail — Fortinet FortiMail Path Traversal Vulnerability
added 2026-10-01
CVE-2025-25249
Multiple Products — Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability
added 2026-09-09
CVE-2025-68686
FortiOS — Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
added 2026-07-27
CVE-2026-25089
FortiSandbox — Fortinet FortiSandbox OS Command Injection Vulnerability
added 2026-07-16
CVE-2026-39808
FortiSandbox — Fortinet FortiSandbox OS Command Injection Vulnerability
added 2026-07-16

View all →

Related CVEs

Same severity, most recent

CVE-2026-19122
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow an authenticated privileged attacker to send unauthorized requests from the system due to server-side request forgery. This could be used to enumerate network resources or to support further attacks.
2026-11-07 · score 3.8
CVE-2026-17140
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Input supplied by a user can influence code generated by the product, which could lead to code execution.
2026-11-07 · score 3.3
CVE-2026-17062
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify internal requests due to improper neutralization of argument delimiters. Special characters in user-supplied input are not handled safely, which could allow additional parameters to be added to a request made by the server.
2026-11-07 · score 2.7
CVE-2026-119213
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (FeedIntegration::notify()) opens a ticket from each public form submission and, for a logged-out submitter, resolves the submitted email to an existing WordPress account via get_user_by('email', ...) without verifying the submitter controls that address, then passes the attacker-supplied data to Customer::maybeCreateCustomer(). This makes it possible for unauthenticated attackers to overwrite a limited set of a registered customer's stored profile fields where an administrator has enabled a FluentSupport feed on a public form. The email address, role and status are never changed; first and last name are overwritten only when the target user has no name set in user meta; and other fields (title, address, city, state, zip, country) are writable only where an administrator has mapped them in the feed.
2026-11-07 · score 3.7
CVE-2026-71863
SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the journalist alert key filename empty, causing the copy task to transfer every file in ~/.config/securedrop-admin/, including Onion Service client authentication credentials, to the Monitor Server. An attacker must first compromise the privileged Monitor Server to obtain the credentials, and the credentials remain an additional protection layer rather than sufficient access by themselves because the Journalist Interface still requires a username, passphrase, and MFA, while SSH access still requires SSH keys. This issue is fixed in version 2.16.1.
2026-11-06 · score 2.6