How do you patch or mitigate CVE-2021-44168 (Fortinet FortiOS Arbitrary File Download)?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

CISA's required action for CVE-2021-44168 is to apply updates per vendor instructions. In practice, find every instance of Fortinet FortiOS in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What patching CVE-2021-44168 should look like in a live FortiOS estate

Start by locating every Fortinet FortiOS deployment, including appliances that are internet-facing, remotely managed, or sitting behind another perimeter device. For this class of flaw, the safest path is to apply the vendor security update exactly as documented, then confirm the device is on the expected build and no longer exposes the vulnerable path. If patching is delayed, remove public exposure or retire the device from service.

That sequence matters because internet-exposed edge devices are often the first place attackers probe for exploitation. NHIMG’s Edge Device Security Guide is useful here because the same operational problems, exposure of management surfaces, weak logging, and end-of-life appliances, tend to turn a vendor fix into a real-world incident if they are not addressed together.

Do not treat “patched” as the end state until you have verified the device inventory, the maintenance window, and the rollback plan. For appliances that also carry administration or VPN functions, the patch decision is often coupled to service continuity, so the practical question is whether you can update without leaving the product externally reachable longer than necessary.

Why this FortiOS vulnerability deserves urgent handling

CVE-2021-44168 is an arbitrary file download issue, which means the primary concern is unauthorized access to local files that may contain configuration data, credentials, or other sensitive operational material. The moment an edge appliance can leak files, the issue can shift from a simple software bug to a broader compromise path, especially if the downloaded content helps an attacker move deeper into the environment.

Vendor-advised patching is therefore the baseline, not a nice-to-have. If you need help structuring the response around a broader CVE workflow, the Vulnerability Management Guide is the right internal reference point because the decision here is not only “can we patch,” but also “how quickly can we verify exposure, remediate, and prove closure?”

Where the product cannot be updated immediately, the mitigation priority is to shrink exposure rather than search for compensating controls that are weaker than the fix. In practice that means limiting or removing internet reachability, restricting administrative access paths, and treating any exposed FortiOS instance as a candidate for accelerated remediation.

What to check after remediation, and what to assume may already be exposed

After patching or isolating the device, review logs for earlier exploitation indicators and look for unusual downloads, configuration access, or follow-on access attempts. The direct answer on the page is explicit that attackers used this flaw in the wild, so post-remediation review is not optional housekeeping, it is part of the incident question you are trying to answer.

If the device was externally reachable before the fix, assume the blast radius may include whatever secrets, configuration material, or management data the appliance could access. When edge devices are involved, compromise often persists through stolen credentials or configuration knowledge even after the vulnerable software is updated, which is why the review step should be tied to credential and access-path assessment, not just log retention.

A useful check is whether the device handled sensitive administration or remote access functions. If it did, confirm whether any stored secrets, API material, or session-bearing data could have been exposed and whether follow-on rotation is needed for dependent systems.

Risk and Threat Considerations

Exposure is highest when FortiOS appliances are internet-facing or reachable from untrusted networks, because arbitrary file download flaws can reveal data that supports later access, persistence, or lateral movement. The practical risk is not only the initial download, but the value of whatever the attacker can read next.

Failure mechanism: A remote requester can trigger retrieval of files that were never meant to be exposed, then use the downloaded material to map the appliance, harvest sensitive operational data, or target adjacent systems that trust the appliance.

Impact: The outcome can include credential exposure, disclosure of configuration and topology details, and a broader compromise path if the appliance protects remote access or administration functions.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	ID.AM-01 — Asset Inventory	FortiOS remediation starts with finding every affected appliance in scope.
	PR.PS-05 — Installation and Configuration Management	Applying vendor updates and documented mitigations is the core response action.
	DE.CM-01 — Networks and Network Services Monitored to Find Potential Cybersecurity Events	Post-fix log review and monitoring are needed to spot earlier exploitation.
Recommendation — Inventory all FortiOS assets before you patch or isolate them. Apply the vendor update or mitigation and verify the configured state matches it. Review appliance logs and monitoring for signs of pre-remediation abuse.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	This is a vulnerability remediation workflow with exposure verification and prioritization.
Recommendation — Track the appliance, remediate it, and validate closure in your vulnerability program.

Practitioner Guidance

What to prioritize: Patch the highest-exposure FortiOS instances first, especially any appliance with direct internet reachability or remote administration exposure. If you cannot patch immediately, remove the device from service or isolate it so the vulnerable path is no longer reachable.

What to verify: Confirm the actual running build after remediation, then validate that the device no longer exposes the vulnerable surface and that log coverage is sufficient to review pre-patch activity. If logs are incomplete, treat that as a visibility gap, not as evidence of safety.

Decision rule: If the appliance may have been reachable by attackers before remediation, assume potential pre-patch exposure and review adjacent credentials, sessions, and dependent access paths before declaring the issue closed.

Practitioner takeaway: For an actively exploited edge-device flaw, patching is necessary but not sufficient, the real objective is to remove exposure fast, then prove whether the device was already used as an access point or data-exposure source.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org