Security Advisory 2021-076

Release Date:

Fortinet Critical Vulnerability



  • 18/12/2021 --- v1.0 -- Initial publication


On December 15th, Fortinet PSIRT updated its advisory related to CVE-2021-44228 and CVE-2021-45046 affecting Fortinet products [1]. While these CVE affect the Java logging library log4j, all products using this library are vulnerable to Unauthenticated Remote Code Execution [2].

Technical Details

The vulnerability exists in the Java logging library log4j. An unauthenticated remote attacker might exploit this vulnerability by sending specially crafted content to the application to execute malicious code on the server [2].

Affected products and fixed versions

Affected productFixed version
FortiCASBFixed on 2021-12-10
FortiConverter PortalFixed on 2021-12-10
FortiCWPFixed on 2021-12-10
FortiEDR CloudNot exploitable. Additional precautionary mitigations put in place on 2021-12-10
FortiInsightNot exploitable. Additional precautionary mitigations being investigated.
FortiIsolatorFix scheduled for version 2.3.4
FortiMonitorMitigations for NCM [3] & Elastiflow [4] available
FortiPortalFixed in 6.0.8 and 5.3.8
FortiSIEMMitigation available [5]
ShieldXFix scheduled for versions 2.1 and 3.0 - ETA 2021/12/17


CERT-EU recommends applying the fixes or the mitigation provided by Fortinet PSIRT as soon as possible. Additionally, the Fortinet PSIRT provide:

  • IPS Signature protection (FortiOS): VID 51006
  • IPS Signature protection (FortiADC & FortiProxy): version 19.215
  • Web Application Firewall Signature (FortiWeb & FortiWeb Cloud): database > 0.00305

Please note that IPS and WAF signatures are not sufficient to fully mitigate the vulnerabilities.






We got cookies

We only use cookies that are necessary for the technical functioning of our website. Find out more on here.