CVE-2021-44168 is an arbitrary file download vulnerability in Fortinet FortiOS. CISA added it to the Known Exploited Vulnerabilities catalogue on 10 December 2021, which means attackers have used it in real attacks. Fortinet FortiOS “execute restore src-vis” downloads code without integrity checking, allowing an attacker to arbitrarily download files.
What makes this vulnerability class dangerous in FortiOS
An arbitrary file download flaw is dangerous because it breaks the normal trust boundary around what a system will retrieve and store. In a security appliance, that can expose configuration material, scripts, logs, or other files that help an attacker understand the environment or prepare follow-on activity.
For FortiOS specifically, the issue matters because the vulnerable restore path can fetch content without integrity checking. That means the appliance may accept attacker-controlled content as if it were legitimate, which turns a management feature into a file retrieval primitive.
How organisations assess exposure
Exposure assessment starts with inventorying every Fortinet FortiOS instance, including appliances that are not obviously internet-facing but are reachable from trusted internal networks or management segments. Organisations should also review vendor advisories and the CVE Program record so they are working from the authoritative vulnerability identifier and description.
Because this vulnerability was added to CISA’s Known Exploited Vulnerabilities catalogue, it should be treated as an exploited issue rather than a theoretical bug. The practical question is not only whether the product is deployed, but whether the affected management surface is reachable and whether compensating controls exist while remediation is being scheduled. The NIST National Vulnerability Database is a useful companion for record lookup and correlation.
Remediation and compensating controls
The correct priority is to remove the vulnerable condition by applying the vendor’s fix path for the exact FortiOS build in use. Until that is possible, reduce exposure by limiting administrative reachability, restricting who can invoke restore functionality, and placing the appliance behind tightly controlled management access paths.
Where patch timing is constrained, organisations should also harden surrounding controls: segment management interfaces, enforce strong authentication on administrative access, and watch for any configuration or file-transfer activity that does not fit the normal operating pattern. A vulnerability-management process that tracks asset scope, KEV status, exceptions, and remediation verification is the right operational backdrop for this kind of issue, as outlined in the Vulnerability Management Guide.
Detection and compromise review
Detection should focus on signs that the appliance retrieved unexpected files or that an attacker used the download path as part of a broader intrusion. Review logs for unusual restore operations, new outbound fetches, and management actions performed outside established change windows.
After patching, organisations should still review the device for signs of prior compromise. If the vulnerability was exercised, any secrets, configuration artefacts, or administrative sessions exposed through the appliance may have been observed or copied. A post-patch review should therefore include credential rotation where the appliance could have held sensitive material, and, where relevant, follow-up analysis of adjacent systems that trust the FortiOS device. For a wider view of how exploited vulnerabilities can feed credential theft and lateral movement, see the State of NHI & AI Agent Breach Report 2026.
Risk and Threat Considerations
This flaw is attractive to attackers because network appliances often sit close to privileged management paths and sensitive configuration data. Once an attacker can coerce file download behaviour, the device may become a stepping stone to deeper access, reconnaissance, or persistence.
Failure mechanism: The appliance accepts a restore-related download without verifying that the content is legitimate, so the integrity assumption around the retrieved file fails.
Impact: Attackers can use the weakness to obtain files they should not be able to access, potentially enabling further compromise of the appliance and any secrets or operational details it protects.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This CVE requires prompt identification and remediation of known exploited vulnerabilities. |
| Recommendation — Prioritize, patch, or mitigate the FortiOS vulnerability under continuous vulnerability management. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | The issue is a software flaw requiring timely remediation and verification. |
| CM-6 — Configuration Settings | Hardening restore paths and management interfaces depends on secure configuration. | |
| IA-5 — Authenticator Management | Exploitation can expose secrets and sessions that should be rotated or invalidated. | |
| Recommendation — Track, remediate, and verify the FortiOS flaw through formal flaw remediation. Restrict administrative and restore-related settings to reduce exploitable exposure. Rotate exposed credentials and manage authenticators after suspected appliance compromise. | ||
| ISO/IEC 27001:2022 | A.8.8 — Management of technical vulnerabilities | This vulnerability is a technical weakness that requires structured vulnerability handling. |
| Recommendation — Apply technical vulnerability management to assess, prioritize, and close the FortiOS issue. | ||
Practitioner Guidance
Why practitioners should care: Treat KEV-listed appliance vulnerabilities as operationally urgent because edge and management systems often become high-value footholds when exploited. For this class of issue, the exposure is not just the bug itself, but the trust placed in the device’s administrative workflow.
What to watch for: Pay close attention to restore activity, unexpected file retrieval, and any appliance behaviour that suggests configuration or secret material may have been accessed. If those signals appear, assume the device may need both remediation and compromise review, not just a routine patch.
Related resources from NHI Mgmt Group
- CVE-2021-26085 (Atlassian Confluence Server Pre-Authorization Arbitrary File Read)
- How should security teams validate file download features before attackers abuse them for arbitrary file reads?
- How should security teams validate suspected arbitrary file download flaws in web applications before treating them as exploitable?
- Why do arbitrary file download bugs create real risk even when they look like a simple read-only issue?