Loading story…
Fortinet disclosed active exploitation of CVE-2024-47575, a critical CVSS 9.8 vulnerability in FortiManager and FortiManager Cloud. A remote unauthenticated attacker can send a specially crafted command to execute arbitrary code and take control of a vulnerable FortiManager appliance; public proof-of-concept exploit code was available.
Attackers can abuse a valid FortiGate certificate to register an unauthorized device, potentially exposing managed network configurations and VPN information. Fortinet issued additional fixes after determining that its initial remediation could leave previously compromised environments exposed through a trusted device; affected organizations should apply the latest patches and mitigations, investigate for prior compromise using supplied indicators, and reset accounts and renew certificates where compromise is identified.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Proof-of-concept exploit code for unpatched FortiManager variants was available, enabling exploitation of CVE-2024-47575 through specially crafted commands.
Fortinet warned that CVE-2024-47575, a CVSS 9.8 unauthenticated remote code execution flaw in FortiManager and FortiManager Cloud, was being actively exploited. Successful exploitation could allow an attacker to take control of a vulnerable FortiManager system.
Fortinet released an additional patch and mitigation guidance, including blocking unknown devices and using custom certificates. It also published indicators of compromise in advisory FG-IR-24-423 to support investigations of potential historical compromise.
Researchers determined that Fortinet's initial remediation could leave previously compromised systems exposed: a trusted device could still execute code on a patched system. Attackers could register an unauthorized device using a valid FortiGate certificate and potentially access network configurations and VPN data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed two critical vulnerabilities affecting **FortiWeb** and **FortiManager**, both of which have been exploited in the wild and can lead to full device compromise. In FortiWeb, multiple versions are affected by an unauthenticated SQL injection flaw that lets attackers send crafted HTTP or HTTPS requests to execute unauthorized SQL commands, bypass access controls, read sensitive configuration and user data, alter or delete database records, and potentially escalate to complete system takeover. Fortinet advised customers to upgrade immediately to fixed releases or disable the HTTP/HTTPS management interface as a temporary workaround. In FortiManager, the critical flaw tracked as `CVE-2024-47575` allows unauthenticated remote code execution and remote command execution, with exploitation observed globally and against Finnish organizations. A successful attack can give intruders control of vulnerable FortiManager systems and expose connected device configuration data and passwords. Fortinet issued patches for most affected branches, while **FortiManager Cloud 6.4** has no fix and must be upgraded; the company also warned that if exploitation is suspected, patching alone is insufficient and organizations should perform a full incident investigation using Fortinet’s compromise-assessment guidance.
Jun 29, 2026
Fortinet FortiManager is affected by a **critical pre-authentication remote code execution** vulnerability tracked as `CVE-2024-47575`, with public reporting and government advisories identifying the flaw as a high-severity risk to exposed management infrastructure. A technical write-up described the issue as a pre-auth RCE chain in FortiManager, indicating that an unauthenticated attacker could potentially reach code execution without valid credentials. COLCERT separately issued an alert on `CVE-2024-47575`, reinforcing the vulnerability's critical status and highlighting it for defenders in enterprise and government environments that rely on FortiManager for centralized administration of Fortinet devices. The combined reporting points to an urgent need for organizations using FortiManager to identify affected deployments, prioritize vendor guidance, and accelerate patching or other mitigations for internet-accessible systems.
Aug 1, 2026
Fortinet patched **CVE-2024-47575**, a critical FortiManager zero-day in the `fgfmd` API that allows unauthenticated attackers to inject commands, execute arbitrary code, access sensitive data, and potentially take control of FortiManager and managed devices. The flaw carries a **CVSS 9.8** rating, and Fortinet said it had already warned customers and issued temporary mitigation guidance before releasing fixed versions for FortiManager and FortiManager Cloud. Mandiant reported that the vulnerability was exploited in the wild from at least **June 27, 2024**, with mass exploitation observed in October and more than **50 potentially compromised** internet-exposed FortiManager appliances identified across multiple industries. The activity, tracked as **UNC5820** and also referenced by Fortinet as **FG-IR-24-423**, involved staging and exfiltrating configuration data from managed FortiGate devices, including detailed appliance configurations and **FortiOS256**-hashed user passwords; defenders were urged to upgrade immediately, restrict administrative exposure, tighten access controls, and review logs and published indicators of compromise.
Jul 24, 2026