CVE-2024-23108: FortiSIEM OS command injection via crafted API requests

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityPre-auth network-reachable OS command injection with a 9.8 CVSS score and very high EPSS probability makes this an urgent patching target.

What it is

FortiSIEM fails to neutralize special elements used in OS commands, allowing command injection through crafted API requests. With a CVSS 3.1 score of 9.8 and network reachability without authentication, this is a severe pre-auth remote code execution risk for exposed instances.

Impact

An attacker can execute unauthorized code or commands on the FortiSIEM host, gaining control of the appliance and any data or credentials it processes.

Attack surface

Reachable over the network via crafted API requests (AV:N, PR:N, UI:N), so no authentication or user interaction is required per the CVSS vector. The record does not specify which API endpoints or versions are affected.

Exploitation

Not listed in CISA KEV and no ransomware use documented, but EPSS is 0.78375 (99.56th percentile), indicating high predicted exploitation activity; a public proof-of-concept repository is referenced.

What to do

• Apply the Fortinet vendor fix for FG-IR-23-130 as soon as possible.
• Restrict network access to FortiSIEM API interfaces to trusted management networks only.
• Audit and rotate credentials and secrets stored on or processed by FortiSIEM hosts.
• Monitor FortiSIEM hosts for unexpected child processes or outbound connections from the API service.

Detection

• Alert on suspicious process creation spawned by FortiSIEM web/API service processes.
• Inspect API request logs for command metacharacters and unusual parameters.
• Monitor for outbound connections from FortiSIEM hosts to unfamiliar external addresses.
• Review host logs for shell execution or file writes outside normal FortiSIEM operations.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.