CVE-2024-47569

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-14 · updated 2026-10-22
Weakness: CWE-201

Description

A insertion of sensitive information into sent data vulnerability in Fortinet FortiMail 7.4.0 through 7.4.2, FortiMail 7.2.0 through 7.2.6, FortiMail 7.0 all versions, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiNDR 7.6.0 through 7.6.1, FortiNDR 7.4.0 through 7.4.8, FortiNDR 7.2 all versions, FortiNDR 7.1 all versions, FortiNDR 7.0 all versions, FortiNDR 1.5 all versions, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.8, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4.0 through 6.4.15, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.4, FortiProxy 7.2.0 through 7.2.10, FortiProxy 7.0 all versions, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions, FortiRecorder 7.2.0 through 7.2.1, FortiRecorder 7.0.0 through 7.0.4, FortiTester 7.4.0 through 7.4.2, FortiTester 7.3 all versions, FortiTester 7.2 all versions, FortiTester 7.1 all versions, FortiTester 7.0 all versions, FortiTester 4.2 all versions, FortiVoice 7.0.0 through 7.0.4, FortiVoice 6.4.0 through 6.4.9, FortiVoice 6.0.7 through 6.0.12, FortiWeb 7.6.0, FortiWeb 7.4.0 through 7.4.4, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions, FortiWeb 6.4 all versions allows attacker to disclose sensitive information via specially crafted packets.

Affected products

Fortinet FortiMail: from 7.0.0 before 7.2.7; from 7.4.0 before 7.4.3 — fixed in 7.2.7, 7.4.3
Fortinet FortiManager: from 7.4.1 before 7.4.4; from 7.6.0 before 7.6.2 — fixed in 7.4.4, 7.6.2
Fortinet FortiManager Cloud: from 7.4.1 before 7.4.4 — fixed in 7.4.4
Fortinet FortiNDR: from 1.5.0 before 7.4.9; from 7.6.0 through 7.6.2 — fixed in 7.4.9
Fortinet FortiOS (FortiGate): from 6.0.0 before 6.4.16; from 7.0.0 before 7.0.16; from 7.2.0 before 7.2.9; from 7.4.0 before 7.4.5; 7.6.0 — fixed in 6.4.16, 7.0.16, 7.2.9, 7.4.5
Fortinet FortiPAM: from 1.0.0 through 1.3.1
Fortinet FortiProxy: from 1.0.0 before 7.2.11; from 7.4.0 before 7.4.5 — fixed in 7.2.11, 7.4.5
Fortinet FortiRecorder: from 7.0.0 before 7.0.5; from 7.2.0 before 7.2.2 — fixed in 7.0.5, 7.2.2
Fortinet FortiSASE: 24.3.20
Fortinet FortiTester: from 4.2.0 before 7.4.3 — fixed in 7.4.3
Fortinet FortiVoice: from 6.0.7 before 6.4.10; from 7.0.0 before 7.0.5 — fixed in 6.4.10, 7.0.5
Fortinet FortiWeb: from 6.4.0 before 7.4.5; 7.6.0 — fixed in 7.4.5

How to fix

Upgrade to a fixed version: Fortinet FortiMail 7.2.7, 7.4.3; Fortinet FortiManager 7.4.4, 7.6.2; Fortinet FortiManager Cloud 7.4.4; Fortinet FortiNDR 7.4.9; Fortinet FortiOS (FortiGate) 6.4.16, 7.0.16, 7.2.9, 7.4.5; Fortinet FortiProxy 7.2.11, 7.4.5; Fortinet FortiRecorder 7.0.5, 7.2.2; Fortinet FortiTester 7.4.3; Fortinet FortiVoice 6.4.10, 7.0.5; Fortinet FortiWeb 7.4.5. Check the vendor advisory for mitigations.

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-228

Get alerted when CVE-2024-47569 or the next vulnerability affects your stack