Security readout for executives and security teams
Plain-English summary
This issue affects specific Fortinet FortiWeb versions and could let an authenticated attacker run operating-system commands through the FortiWeb command-line interpreter. It is not described as unauthenticated or internet-ranged exploitation. The main business risk is escalation from a compromised or malicious privileged account into appliance-level control.
Executive priority
Treat this as a moderate-priority appliance hardening and upgrade item. It is less urgent than unauthenticated remote code execution, but FortiWeb often protects critical web applications, so privileged compromise could have outsized operational impact.
Technical view
CVE-2021-36195 is multiple command injection vulnerabilities in FortiWeb CLI handling. Fortinet lists FortiWeb 6.4.1, 6.4.0, 6.3.0-6.3.15, 6.2.0-6.2.6, and 6.1.0-6.1.2 as affected. CVSS 3.1 is 4.2 with local attack vector and high privileges required.
Likely exposure
Exposure is most likely where affected FortiWeb appliances are still running and CLI or administrative access is available to many users, poorly segmented, or reachable after credential compromise. The provided sources do not identify broader product families or cloud services as affected.
Exploitation context
The source bundle does not indicate CISA KEV listing or confirmed active exploitation. The CVSS temporal vector includes proof-of-concept maturity, but exploitation still requires authenticated, high-privilege local access according to the provided vector.
Researcher notes
Evidence is limited to the CVE description, CVSS vector, affected FortiWeb ranges, and Fortinet advisory reference. The sources do not provide exploit details, named fixed versions, or active exploitation evidence in this bundle.
Mitigation direction
- Check Fortinet FG-IR-21-157 for fixed FortiWeb versions and upgrade guidance.
- Prioritize upgrades for appliances on affected FortiWeb release branches.
- Restrict CLI and administrative access to trusted administrators and management networks.
- Review FortiWeb administrator accounts for unnecessary privileges or stale access.
- Monitor FortiWeb systems for unexpected shell activity or configuration changes.
Validation and detection
- Inventory all FortiWeb appliances and record exact firmware versions.
- Compare versions against Fortinet's affected ranges for CVE-2021-36195.
- Confirm administrative and CLI access is limited to approved operators.
- Review recent admin activity for unusual command-line or configuration behavior.
- Track remediation evidence against the Fortinet advisory, not inferred fixes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-36195 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C0.83.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.2MediumVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:U/RC:C
Source materials
- CVE List V5 sourceCVE List V5
- https://fortiguard.com/advisory/FG-IR-21-157CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.