Loading story…
Fortinet FortiManager is affected by a critical pre-authentication remote code execution vulnerability tracked as CVE-2024-47575, with public reporting and government advisories identifying the flaw as a high-severity risk to exposed management infrastructure. A technical write-up described the issue as a pre-auth RCE chain in FortiManager, indicating that an unauthenticated attacker could potentially reach code execution without valid credentials.
COLCERT separately issued an alert on CVE-2024-47575, reinforcing the vulnerability's critical status and highlighting it for defenders in enterprise and government environments that rely on FortiManager for centralized administration of Fortinet devices. The combined reporting points to an urgent need for organizations using FortiManager to identify affected deployments, prioritize vendor guidance, and accelerate patching or other mitigations for internet-accessible systems.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
A technical blog post described CVE-2024-47575 as a pre-authentication remote code execution chain affecting Fortinet FortiManager and pointed readers to a post titled "Hop-Skip-FortiJump-FortiJump-Higher" for full details.
COLCERT published advisory AL-2510-053 for a critical FortiManager vulnerability identified as CVE-2024-47575. The visible content does not include technical exploitation details or affected version information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed active exploitation of **CVE-2024-47575**, a critical `CVSS 9.8` vulnerability in FortiManager and FortiManager Cloud. A remote unauthenticated attacker can send a specially crafted command to execute arbitrary code and take control of a vulnerable FortiManager appliance; public proof-of-concept exploit code was available. Attackers can abuse a valid FortiGate certificate to register an unauthorized device, potentially exposing managed network configurations and VPN information. Fortinet issued additional fixes after determining that its initial remediation could leave previously compromised environments exposed through a trusted device; affected organizations should apply the latest patches and mitigations, investigate for prior compromise using supplied indicators, and reset accounts and renew certificates where compromise is identified.
Aug 31, 2026
Fortinet disclosed two critical vulnerabilities affecting **FortiWeb** and **FortiManager**, both of which have been exploited in the wild and can lead to full device compromise. In FortiWeb, multiple versions are affected by an unauthenticated SQL injection flaw that lets attackers send crafted HTTP or HTTPS requests to execute unauthorized SQL commands, bypass access controls, read sensitive configuration and user data, alter or delete database records, and potentially escalate to complete system takeover. Fortinet advised customers to upgrade immediately to fixed releases or disable the HTTP/HTTPS management interface as a temporary workaround. In FortiManager, the critical flaw tracked as `CVE-2024-47575` allows unauthenticated remote code execution and remote command execution, with exploitation observed globally and against Finnish organizations. A successful attack can give intruders control of vulnerable FortiManager systems and expose connected device configuration data and passwords. Fortinet issued patches for most affected branches, while **FortiManager Cloud 6.4** has no fix and must be upgraded; the company also warned that if exploitation is suspected, patching alone is insufficient and organizations should perform a full incident investigation using Fortinet’s compromise-assessment guidance.
Jun 29, 2026
Fortinet disclosed **CVE-2026-70468**, a high-severity authentication bypass flaw in **FortiManager** and **FortiManager Cloud** that could let an unauthenticated remote attacker gain improper access to vulnerable systems. The issue is tracked as **CWE-288** and carries a **CVSS v3.1 score of 8.1**. Affected versions include FortiManager and FortiManager Cloud `7.6.1`, `7.4.3` through `7.4.5`, and `7.2.5` through `7.2.9`, and Fortinet has directed customers to install fixed releases and vendor patches. A related **Canadian Centre for Cyber Security** notice, **AV26-812**, said multiple Fortinet products are affected, naming **FortiClientWindows**, **FortiManager**, and **FortiManager Cloud** across several version branches. The advisory did not publish exploit details, but urged administrators to review Fortinet PSIRT and FortiGuard guidance and apply updates as they become available, underscoring the need for rapid patching across exposed management infrastructure.
Aug 12, 2026