CVE-2024-21762: Fortinet FortiOS Out-of-Bound Write Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2024-02-09
EPSS: 84.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-09 · updated 2026-10-22
Weakness: CWE-787

Description

A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests

Summary

CVE-2024-21762 is a critical out-of-bounds write in Fortinet FortiOS and FortiProxy that lets an attacker execute unauthorized code or commands via specially crafted requests. It affects FortiOS 6.0 through 7.4.2 and FortiProxy 1.0 through 7.4.2, with a CVSS score of 9.8. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and EPSS estimates an 84.6% probability of exploitation in 30 days. Apply the vendor fixes (FortiOS 6.0.18, 6.2.16, 6.4.15, 7.0.14; FortiProxy 2.0.14, 7.0.15, 7.2.9, 7.4.3) or follow vendor mitigations, and discontinue use if no mitigation is available.

تُعدّ CVE-2024-21762 ثغرة كتابة خارج الحدود (out-of-bounds write) حرجة في Fortinet FortiOS وFortiProxy، وتتيح للمهاجم تنفيذ تعليمات برمجية أو أوامر غير مصرّح بها عبر طلبات مصممة خصيصًا. تؤثر الثغرة في FortiOS من 6.0 حتى 7.4.2 وفي FortiProxy من 1.0 حتى 7.4.2، بدرجة خطورة CVSS تبلغ 9.8. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال مع استغلال نشط، وتقدّر EPSS احتمال الاستغلال خلال 30 يومًا بنسبة 84.6%. طبّق إصلاحات المورّد (FortiOS 6.0.18 و6.2.16 و6.4.15 و7.0.14؛ FortiProxy 2.0.14 و7.0.15 و7.2.9 و7.4.3) أو اتبع تعليمات التخفيف من المورّد، وتوقّف عن استخدام المنتج إذا لم يتوفر تخفيف.

Affected products

Fortinet FortiOS (FortiGate): from 6.0.0 before 6.0.18; from 6.2.0 before 6.2.16; from 6.4.0 before 6.4.15; from 7.0.0 before 7.0.14; from 7.2.0 before 7.2.7; from 7.4.0 before 7.4.3 — fixed in 6.0.18, 6.2.16, 6.4.15, 7.0.14, 7.2.7, 7.4.3
Fortinet FortiProxy: from 1.0.0 before 2.0.14; from 7.0.0 before 7.0.15; from 7.2.0 before 7.2.9; from 7.4.0 before 7.4.3 — fixed in 2.0.14, 7.0.15, 7.2.9, 7.4.3

How to fix

Upgrade to a fixed version: Fortinet FortiOS (FortiGate) 6.0.18, 6.2.16, 6.4.15, 7.0.14; Fortinet FortiProxy 2.0.14, 7.0.15, 7.2.9, 7.4.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-21762 or the next vulnerability affects your stack