CVE-2024-21762

Fortinet FortiOS Out-of-Bound Write Vulnerability

Exploited in attacks Used by ransomware Critical 9.6 Attack chance: 85%

What it is

A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests

CISA: Fortinet FortiOS contains an out-of-bound write vulnerability that allows a remote unauthenticated attacker to execute code or commands via specially crafted HTTP requests.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: February 16, 2024

Added to the CISA list: February 9, 2024
Published: February 9, 2024
Severity: Critical 9.6 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 85% in the top 0.3% of all known vulnerabilities
Weakness: CWE-787
More details: NVD · CVE.org · CISA

All references (1)

https://fortiguard.com/psirt/FG-IR-24-015

More exploited flaws from Fortinet

Added	Vulnerability	Product	Severity	Attack chance
Jul 27, 2026	Exposure of Sensitive Information to an Unauthorized ActorCVE-2025-68686	FortiOS	Medium 5.3	29%
Jun 25, 2025	Use of Hard-Coded CredentialsCVE-2019-6693used by ransomware	FortiOS	Medium 6.5	6.6%
Mar 14, 2023	Path TraversalCVE-2022-41328	FortiOS	Medium 6.5	11%
Dec 13, 2022	Heap-Based Buffer OverflowCVE-2022-42475used by ransomware	FortiOS	Critical 9.3	99.5%
Dec 10, 2021	Arbitrary File DownloadCVE-2021-44168	FortiOS	Low 3.3	0.9%
Nov 3, 2021	Default ConfigurationCVE-2019-5591used by ransomware	FortiOS	Medium 6.5	19%
Nov 3, 2021	SSL VPN Path TraversalCVE-2018-13379used by ransomware	FortiOS	Critical 9.1	>99.9%
Nov 3, 2021	SSL VPN Improper AuthenticationCVE-2020-12812used by ransomware	FortiOS	High 7.5	45%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.