What’s Vulnerable › Vulnerabilities
CVE-2024-33507
- Severity: critical (CVSS 9.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-10-14 · updated 2026-06-17
- Weakness: CWE-613
Description
An insufficient session expiration vulnerability [CWE-613] and an incorrect authorization vulnerability [CWE-863] in FortiIsolator 2.4.0 through 2.4.4, 2.3 all versions, 2.2.0, 2.1 all versions, 2.0 all versions authentication mechanism may allow remote unauthenticated attacker to deauthenticate logged in admins via crafted cookie and remote authenticated read-only attacker to gain write privilege via crafted cookie.
Affected products
- Fortinet FortiIsolator: from 2.3.0 before 2.4.5 — fixed in 2.4.5
How to fix
Upgrade to a fixed version: Fortinet FortiIsolator 2.4.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-33507 or the next vulnerability affects your stack