Is CVE-2021-44168 (Fortinet FortiOS Arbitrary File Download) being exploited in the wild?

What CVE-2021-44168 Means Operationally

CVE-2021-44168 is not just a disclosure item to log and revisit later. The issue affects Fortinet FortiOS and involves arbitrary file download through the execute restore src-vis function, which means the security question is whether an exposed appliance can be instructed to fetch content without integrity validation. For defenders, that immediately raises the bar from “known bug” to “credible compromise path.”

Because the vulnerable behavior occurs in a core appliance function, the first practical question is whether the device is internet-facing, reachable from untrusted segments, or used as a management or edge control point. For this class of flaw, exposure is often determined by where the appliance sits in the network and who can reach the relevant interface, not by whether users think the feature is “actively used.”

An Edge Device Security Guide is useful here because appliance security depends on more than patch status: management exposure, firmware integrity, and logging all affect whether exploitation will be noticed and contained.

Why KEV Listing Changes the Response

CISA KEV inclusion is a strong operational signal because it means the vulnerability has credible evidence of active exploitation, not merely theoretical exploitability. That changes prioritisation: remediation should move ahead of routine backlog ordering, exception queues, and non-urgent maintenance windows.

The right response is to treat the appliance as a priority asset, verify whether it is vulnerable, and move to vendor guidance quickly rather than waiting for a broader patch cycle. If the device performs perimeter, remote access, or administrative functions, any compromise or file retrieval abuse can have a disproportionate effect on the surrounding environment.

For a vulnerability with active exploitation, the best reference points are the CISA Known Exploited Vulnerabilities Catalog and the NIST National Vulnerability Database, which together help confirm status, scope, and prioritisation context.

What to Check Before and After Remediation

First confirm whether any FortiOS appliances are in scope, including lab, branch, backup, and forgotten edge devices. Then confirm whether the vulnerable interface or function is reachable, whether logs show unusual restore activity, and whether the appliance has served as a transit point for other suspicious changes. On devices like this, “no alerts” does not equal “no compromise.”

If patching or replacement must wait, reduce exposure immediately by restricting administrative reachability, tightening segmentation, preserving logs, and hunting for signs of unexpected downloads or configuration changes. If the device stores credentials, tokens, or other sensitive operational material, assume that compromise could require rotation of nearby credentials and sessions, not just the appliance itself.

The Zero-Day and Exploited Vulnerabilities Guide is relevant because the decision path is the same: urgency, containment, verification, and compromise assessment matter more than normal patch cadence when exploitation is already underway.

Risk and Threat Considerations

Arbitrary file download flaws on perimeter appliances are attractive because they often sit in trusted positions, have privileged network reach, and may expose configuration or other sensitive files if abused. Once a device like this is exploited, the concern is not only the original flaw but also what else the attacker can learn or reach from a trusted edge position.

Failure mechanism: The appliance processes a restore request without sufficient integrity checking, allowing an attacker to trigger retrieval of unintended content or leverage the function as an exposure path into sensitive files or operational data.

Impact: That can expose credentials, configuration details, internal topology, or other material that supports follow-on intrusion, persistence, or lateral movement, especially if the device is internet-facing or centrally trusted.

Practitioner Guidance

What to prioritise: Treat all internet-facing or admin-reachable FortiOS devices as urgent candidates for verification first, then isolate any instance that shows suspicious restore activity or unexplained file access. If you have multiple edge devices, focus on the ones with the largest trust footprint and the weakest logging coverage.

What to verify: Confirm version exposure against vendor guidance, review authentication and administrative access history, and look for anomalous downloads, configuration drift, or recent changes that do not match maintenance records. If the appliance was reachable from untrusted networks, add a compromise assessment before declaring it clean.

Practitioner takeaway: For KEV-listed edge-device flaws, the important decision is not whether the vulnerability is serious, but whether the appliance has already crossed the line from patching issue to incident-response issue.

Related resources from NHI Mgmt Group

• How do you patch or mitigate CVE-2021-44168 (Fortinet FortiOS Arbitrary File Download)?
• CVE-2021-44168 (Fortinet FortiOS Arbitrary File Download)
• Is CVE-2021-26085 (Atlassian Confluence Server Pre-Authorization Arbitrary File Read) being exploited in the wild?
• Is CVE-2021-20022 (SonicWall Email Security Unrestricted Upload of File) being exploited in the wild?