Loading story…
Fortinet reported limited active exploitation of CVE-2024-21762, a critical out-of-bounds write vulnerability in the sslvpnd component of FortiOS SSL-VPN. An unauthenticated remote attacker can trigger denial of service or execute arbitrary code, potentially taking control of a vulnerable FortiGate appliance. The vulnerability is rated CVSS 9.6, and public proof-of-concept exploit code became available.
Organizations running affected FortiOS 7.4 and earlier releases should apply Fortinet’s security updates immediately; FortiOS 7.6 is not affected. The Dutch National Cyber Security Centre assessed the issue as High/High due to its impact, active exploitation, and expected exploit availability, and advised disabling SSL-VPN as a temporary mitigation where immediate patching is not possible.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
A proof of concept was published for CVE-2024-21762, the FortiOS SSL-VPN vulnerability with a CVSS score of 9.6.
CVE-2024-23113 was disclosed as a CVSS 9.8 format-string flaw in Fortinet's fgfmd daemon that can allow unauthenticated remote code or command execution. The issue affects specified FortiOS, FortiProxy, and FortiPAM releases; organizations were advised to upgrade to fixed versions or remove FGFM access from interfaces as an interim mitigation.
Researchers disclosed a pre-authentication exploit chain for CVE-2024-21762 that turns a constrained two-byte stack overwrite in FortiGate SSL-VPN chunked-request parsing into remote code execution. The tested exploit used heap grooming, a forged SSL structure, return-oriented programming, and Node.js to obtain a reverse shell on the targeted firmware version.
Fortinet released security updates for FortiOS 7.4 and earlier versions to remediate CVE-2024-21762. FortiOS 7.6 was identified as unaffected, and disabling SSL-VPN was recommended as a temporary workaround when immediate patching was not possible.
Fortinet reported that CVE-2024-21762, a critical FortiOS SSL-VPN flaw in the sslvpnd process, had been actively exploited on a limited basis. The vulnerability can allow unauthenticated attackers to cause denial of service or execute arbitrary code on affected appliances.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
slcyber.io
Open sourcefortiguard.com
Open sourcefortiguard.com
Open sourcencsc.nl
Open sourcewiz.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed multiple critical vulnerabilities in **FortiOS** and related products, including an authentication bypass in **FortiOS** and **FortiProxy** that can grant attackers **super-admin privileges** and is being **actively exploited in the wild**. The flaw can be triggered through specially crafted requests to the **Node.js websocket module** and affects FortiOS `7.0.0` through `7.0.16`, FortiProxy `7.2.0` through `7.2.12`, and FortiProxy `7.0.0` through `7.0.19`. Organizations were told to upgrade to FortiOS `7.0.17+`, FortiProxy `7.2.13+`, or FortiProxy `7.0.20+`, and to apply Fortinet’s recommended mitigations immediately. Separate Fortinet advisories also warned of critical flaws **CVE-2024-21762** and **CVE-2024-23113**, affecting **FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager**. **CVE-2024-21762** carries a **CVSS 9.6** rating, while **CVE-2024-23113** is rated **CVSS 9.8**; both require urgent patching to fixed versions identified by Fortinet. Fortinet and national cyber authorities said defenders should prioritize upgrades across exposed appliances, and for `CVE-2024-21762`, disabling the **SSL VPN** feature can reduce exposure until patches are applied.
Jun 29, 2026
Attackers began exploiting **Fortinet authentication bypass flaw** `CVE-2022-40684` against internet-facing devices shortly after the vulnerability was disclosed, according to SOC observations. The issue affects **FortiOS**, **FortiProxy**, and **FortiSwitchManager**, and allows unauthenticated attackers to send crafted HTTP/HTTPS requests that bypass authentication and gain access to the administrative interface. Observed attacks started within days of disclosure, with defenders warning that public proof-of-concept code could accelerate broader exploitation. Organizations were urged to **upgrade affected versions immediately** or apply Fortinet’s mitigations, including disabling HTTP/HTTPS administrative access where possible and restricting administrative interface access to trusted IP addresses.
Aug 15, 2026
Fortinet disclosed active exploitation of **CVE-2024-47575**, a critical `CVSS 9.8` vulnerability in FortiManager and FortiManager Cloud. A remote unauthenticated attacker can send a specially crafted command to execute arbitrary code and take control of a vulnerable FortiManager appliance; public proof-of-concept exploit code was available. Attackers can abuse a valid FortiGate certificate to register an unauthorized device, potentially exposing managed network configurations and VPN information. Fortinet issued additional fixes after determining that its initial remediation could leave previously compromised environments exposed through a trusted device; affected organizations should apply the latest patches and mitigations, investigate for prior compromise using supplied indicators, and reset accounts and renew certificates where compromise is identified.
Aug 31, 2026