What’s Vulnerable › Vulnerabilities
CVE-2024-48886
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-01-14 · updated 2026-06-17
- Weakness: CWE-1390
Description
A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3 allows attacker to execute unauthorized code or commands via a brute-force attack.
Summary
CVE-2024-48886 is a critical (CVSS 9.8) weak authentication flaw in multiple Fortinet products that allows an attacker to execute unauthorized code or commands via a brute-force attack. Affected versions include FortiOS 7.4.0-7.4.4, 7.2.0-7.2.8, 7.0.0-7.0.15, 6.4.0-6.4.15; FortiProxy 7.4.0-7.4.4, 7.2.0-7.2.10, 7.0.0-7.0.17, 2.0.0-2.0.14; FortiManager 7.6.0-7.6.1, 7.4.1-7.4.3; and FortiManager/FortiAnalyzer Cloud 7.4.1-7.4.3. There is no evidence of active exploitation (not in CISA KEV, SSVC exploitation: none, EPSS 0.5%). Apply the fixed versions: FortiOS 7.0.16, 7.2.9, 7.4.5; FortiProxy 2.0.15, 7.0.18, 7.2.11, 7.4.5; FortiManager 7.4.4, 7.6.2; FortiAnalyzer 7.4.4, 7.6.2; FortiManager Cloud and FortiAnalyzer Cloud 7.4.4.
CVE-2024-48886 هو ثغرة مصادقة ضعيفة خطيرة (CVSS 9.8) في منتجات Fortinet متعددة تسمح للمهاجم بتنفيذ تعليمات برمجية أو أوامر غير مصرح بها عبر هجوم القوة الغاشمة. تشمل الإصدارات المتأثرة FortiOS 7.4.0-7.4.4 و7.2.0-7.2.8 و7.0.0-7.0.15 و6.4.0-6.4.15؛ وFortiProxy 7.4.0-7.4.4 و7.2.0-7.2.10 و7.0.0-7.0.17 و2.0.0-2.0.14؛ وFortiManager 7.6.0-7.6.1 و7.4.1-7.4.3؛ وFortiManager/FortiAnalyzer Cloud 7.4.1-7.4.3. لا يوجد دليل على استغلال نشط (ليس في CISA KEV، استغلال SSVC: لا شيء، EPSS 0.5%). قم بتطبيق الإصدارات المُصلحة: FortiOS 7.0.16 و7.2.9 و7.4.5؛ FortiProxy 2.0.15 و7.0.18 و7.2.11 و7.4.5؛ FortiManager 7.4.4 و7.6.2؛ FortiAnalyzer 7.4.4 و7.6.2؛ FortiManager Cloud وFortiAnalyzer Cloud 7.4.4.
Affected products
- Fortinet FortiAnalyzer: from 7.4.1 before 7.4.4; from 7.6.0 before 7.6.2 — fixed in 7.4.4, 7.6.2
- Fortinet FortiAnalyzer Cloud: from 7.4.1 before 7.4.4 — fixed in 7.4.4
- Fortinet FortiManager: from 7.4.1 before 7.4.4; from 7.6.0 before 7.6.2 — fixed in 7.4.4, 7.6.2
- Fortinet FortiManager Cloud: from 7.4.1 before 7.4.4 — fixed in 7.4.4
- Fortinet FortiOS (FortiGate): from 6.4.0 before 7.0.16; from 7.2.0 before 7.2.9; from 7.4.0 before 7.4.5 — fixed in 7.0.16, 7.2.9, 7.4.5
- Fortinet FortiProxy: from 2.0.0 before 2.0.15; from 7.0.0 before 7.0.18; from 7.2.0 before 7.2.11; from 7.4.0 before 7.4.5 — fixed in 2.0.15, 7.0.18, 7.2.11, 7.4.5
How to fix
Upgrade to a fixed version: Fortinet FortiAnalyzer 7.4.4, 7.6.2; Fortinet FortiAnalyzer Cloud 7.4.4; Fortinet FortiManager 7.4.4, 7.6.2; Fortinet FortiManager Cloud 7.4.4; Fortinet FortiOS (FortiGate) 7.0.16, 7.2.9, 7.4.5; Fortinet FortiProxy 2.0.15, 7.0.18, 7.2.11, 7.4.5. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-48886 or the next vulnerability affects your stack