CVE-2026-59839: FortiOS CLI Path Traversal Arbitrary File Deletion & Code Execution

HERMES

HERMES THREAT SCORE & ADMINISTRATIVE SHELL ESCAPE

Target: Fortinet FortiOS / FortiProxy / FortiPAM Administrative CLI

Confidence: 95%

74 / 100

HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 14 / 20

Threat Activity 12 / 20

Weaponization 15 / 20

Exposure 15 / 20

Prevalence 19 / 20

Impact 18 / 20

Exploit Maturity 14 / 20

Attack Chain Potential 17 / 20

⚖️ Divergence & Operational Rationale

Hermes evaluates CVE-2026-59839 as High severity (HTS 74). While official NVD scoring places it at CVSS 5.5 due to authenticated administrative prerequisites, post-compromise weaponization is severe: an operator with restricted CLI or delegated administrative profiles can bypass filesystem containment, corrupt critical kernel runtime objects, or trigger persistent root execution.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-59839: FortiOS CLI Path Traversal Arbitrary File Deletion & Code ExecutionVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTFortinet FortiOS Gateway

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Fortinet FortiOS Gateway documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

1. Metadata & Attack Surface

Metric	Technical Specification	Operational Impact
CVE Identifier	`CVE-2026-59839`	Standardized vulnerability identifier
Vendor / Advisory	Fortinet / `FG-IR-26-151`	Vendor security bulletin
Affected Products	FortiOS, FortiProxy, FortiPAM	Core enterprise firewall & proxy systems
Affected Releases	FortiOS 7.6.0–7.6.6, 7.4.0–7.4.9, 7.2 (all), 7.0, 6.4	Multi-branch legacy and current builds
Fixed Releases	FortiOS 7.6.7, 7.4.10, 7.2.12	Official security releases
Associated CWE	`CWE-22`: Improper Limitation of a Pathname	Filesystem boundary escape
Access Vector	Authenticated CLI session (SSH/Console)	Local administrative privilege
Exploit Potential	High in post-exploitation persistence chains	Tampering with core OS configurations

2. Technical Root Cause Analysis

The flaw exists within the path sanitization routines of administrative maintenance commands (such as execute backup, diagnose sys, and file export utilities).

CVE-2026-59839 CLI Path Traversal Flow:

  ┌────────────────────────────────────────────────────────┐
  │ Authenticated Administrator (Restricted CLI Profile)   │
  └───────────────────────────┬────────────────────────────┘
                              │
                              │ Malicious CLI invocation with traversal sequences:
                              │ `execute restore config file ../../../etc/shadow`
                              ▼
  ┌────────────────────────────────────────────────────────┐
  │ FortiOS CLI Command Parser                             │
  │ - Incomplete validation of relative path sequences     │
  │ - Resolves target path outside /var/log or /tmp jail   │
  └───────────────────────────┬────────────────────────────┘
                              │
                              ▼
  ┌────────────────────────────────────────────────────────┐
  │ Underling Filesystem Impact                            │
  │ - Critical system file deletion (denial of service)    │
  │ - Overwrite of internal scripts or library loading     │
  └────────────────────────────────────────────────────────┘

The CLI parser failed to strictly enforce canonical path normalization before passing user-supplied path strings to internal C runtime functions (unlink(), fopen(), rename()). When concatenated with prefix paths, directory traversal payloads escaped into /data/config/ and root system directories.

3. Detection & Forensic Signatures

Log Hunting & CLI Audit

Review FortiOS event logs (log filter category 1) for abnormal directory traversal indicators in admin command histories:

date=2026-07-15 time=10:24:12 devname="FG-CORP-EDGE" logid="0100032001"
type="event" subtype="system" level="information" logdesc="Admin action performed"
user="secops_admin" ui="ssh(192.168.10.45)" action="cli"
cmd="execute restore image ../../../bin/init" msg="Admin command executed"

Sigma Rule for Threat Hunting

title: FortiOS CLI Path Traversal Exploitation Attempt
id: 59839e12-45bb-4c28-98e1-fortios-trav
status: experimental
description: Detects directory traversal sequences in FortiOS administrative CLI command logs.
author: Hermes Codex Security Intelligence
logsource:
  product: fortinet
  service: fortios
  category: system
detection:
  selection:
    type: 'event'
    subtype: 'system'
    cmd|contains:
      - '../'
      - '..\\\\'
      - '%2e%2e'
  condition: selection
level: high

4. Remediation & Hardening Playbook

Apply Firmware Upgrade:
Upgrade FortiOS to 7.6.7, 7.4.10, or 7.2.12 immediately. For FortiProxy, upgrade to 7.6.6, 7.4.14, or 7.2.13. For FortiPAM, upgrade to 1.8.3 or higher.

Restrict Administrative CLI Access:
Enforce dedicated management VLANs and restrict SSH/HTTPS administrative interfaces via trusthost configurations:

config system admin
    edit "secops_admin"
        set trusthost1 10.100.0.0 255.255.255.0
        set accprofile "read-only-monitor"
    next
end

Audit Restricted Admin Profiles:
Ensure non-superadmin accounts do not possess execution privileges on diagnostic and restore utility commands.