CVE-2024-21762: Fortinet FortiOS Out-of-Bound Write Vulnerability
Vulnerability summary
CVE-2024-21762 is a critical (CVSS 9.8) Out-of-bounds Write vulnerability in Fortinet FortiOS. It is known to be exploited: CISA lists it, first on 09-02-2024. It has been used in ransomware campaigns. EPSS estimates a 83.43% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities.
Timeline
- 09-02-2024PublishedVulnerability first disclosed.
- 09-02-2024Added to CISA KEVFortinet FortiOS Out-of-Bound Write Vulnerability
- 16-02-2024CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 04-08-2026Last modifiedVulnerability information updated.
Description
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA9.6CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:W/RC:CDiffers
EPSS trend
Probability
83.43%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 83.43% on 21-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 09-02-2024
- Federal due date
- 16-02-2024
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. fortiguard.fortinet.com/psirt/FG-IR-24-015 nvd.nist.gov/vuln/detail/CVE-2024-21762
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Fortinet2 products
- fortios≥ 7.4.0, ≤ 7.4.2 | ≥ 7.2.0, ≤ 7.2.6 | ≥ 7.0.0, ≤ 7.0.13 | ≥ 6.4.0, ≤ 6.4.14 | ≥ 6.2.0, ≤ 6.2.15 | ≥ 6.0.0, ≤ 6.0.17 | ≥ 6.0.0, < 6.0.18 | ≥ 6.2.0, < 6.2.16 | ≥ 6.4.0, < 6.4.15 | ≥ 7.0.0, < 7.0.14 | ≥ 7.2.0, < 7.2.7 | ≥ 7.4.0, < 7.4.3
- fortiproxy≥ 7.4.0, ≤ 7.4.2 | ≥ 7.2.0, ≤ 7.2.8 | ≥ 7.0.0, ≤ 7.0.14 | ≥ 2.0.0, ≤ 2.0.13 | ≥ 1.2.0, ≤ 1.2.13 | ≥ 1.1.0, ≤ 1.1.6 | ≥ 1.0.0, ≤ 1.0.7 | ≥ 1.0.0, < 2.0.14 | ≥ 7.0.0, < 7.0.15 | ≥ 7.2.0, < 7.2.9 | ≥ 7.4.0, < 7.4.3
1 vendor · 2 products
References
2 links- fortiguard.com/psirt/FG-IR-24-015Vendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21762Government ResourceUS Government Resource