CVE-2023-34992: FortiSIEM OS command injection via crafted API requests

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityUnauthenticated network-reachable OS command injection with a 9.8 CVSS score and very high EPSS probability makes this an urgent patch target.

What it is

FortiSIEM fails to neutralize special elements in OS commands, allowing command injection through crafted API requests. With a CVSS 3.1 score of 9.8 and a network-reachable, unauthenticated vector, this is a severe pre-auth remote code execution risk for exposed instances.

Impact

An attacker can execute unauthorized code or commands on the FortiSIEM host, gaining full control of the appliance and any data or credentials it holds. The CVSS impact ratings are high for confidentiality, integrity and availability.

Attack surface

Reached over the network via the FortiSIEM API; the CVSS vector shows no privileges required and no user interaction, so no authentication is needed. Any instance with the API reachable from untrusted networks is exposed.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is 0.80061 (99.6th percentile), indicating a high near-term exploitation likelihood. The only references are vendor advisories, so no public exploit code is confirmed by this record.

What to do

• Apply the Fortinet fix for FG-IR-23-130 as soon as possible; treat this as an emergency patch.
• Restrict API access to trusted management networks and block it from the internet.
• Segment FortiSIEM appliances from general user and production networks to limit lateral movement.
• Rotate credentials and secrets stored on or used by FortiSIEM in case of prior compromise.
• Monitor FortiSIEM for unexpected child processes or outbound connections until patched.

Detection

• Alert on suspicious child processes spawned by FortiSIEM API or web service processes.
• Review API access logs for unusual request patterns, especially command-like parameters.
• Monitor for unexpected outbound network connections from FortiSIEM hosts.
• Watch for new files, scripts or scheduled tasks appearing on FortiSIEM appliances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.