CVE-2024-21762
Published 2024-02-09 · Updated 2026-10-22 · Source psirt@fortinet.com
Summary
CVE-2024-21762 is a critical-severity (CVSS 9.8) vulnerability in Fortinet FortiOS. CISA added it to the Known Exploited Vulnerabilities catalog on February 9, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by February 16, 2024. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Fortinet has 32 vulnerabilities in the KEV catalog, 14 of them linked to ransomware.
All 32 known-exploited Fortinet vulnerabilities →Description
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Fortinet — FortiOS
Name: Fortinet FortiOS Out-of-Bound Write Vulnerability
Date added: 2024-02-09 · Due: 2024-02-16
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.