CVE-2021-44168VulnerabilityPublished 12/10/2021Updated 10/24/2026

CVE-2021-44168: Fortinet FortiOS Arbitrary File Download

Affects Fortinet FortiOSSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 12/10/2021
KEV deadline: 12/24/2021
EPSS: 0.9% chance of exploitation in 30 days – higher than 58% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-44168 (opens in a new tab)

Description

CVE-2021-44168 is a vulnerability in Fortinet FortiOS where the 'execute restore src-vis' command allows arbitrary file download without integrity checking. This flaw enables attackers to download files from the system arbitrarily. The vulnerability has been exploited in the wild and is considered high severity.

Summary

Fortinet FortiOS contains a vulnerability identified as CVE-2021-44168, where the 'execute restore src-vis' command downloads code without verifying its integrity. This lack of integrity checking allows an attacker to arbitrarily download files from the affected system. The vulnerability is classified under CWE-494 (Download of Code Without Integrity Check) and has been confirmed as exploited in the wild. No specific affected versions or patch information is provided in the available data.

Impact

An attacker exploiting this vulnerability can download arbitrary files from the FortiOS system, potentially exposing sensitive information or configuration data. The vulnerability has been actively exploited in the wild, indicating a real risk to affected systems.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable command and limit network exposure of FortiOS management interfaces to trusted users only.

Weaknesses

CWE-494Unclassified weakness (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:55:57 UTC

Weaknesses

References

Related threats