Actively exploited in the wild
Fortinet FortiOS Out-of-Bound Write Vulnerability
Fortinet - FortiOS · Listed in the CISA KEV since 2024-02-09. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-21762
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
An out-of-bounds write vulnerability in Fortinet FortiOS and FortiProxy across multiple versions. It allows an attacker to execute unauthorized code or commands via specifically crafted requests.
Risk Assessment
Potential remote code execution on Fortinet devices, which could lead to full system compromise and network security breach.
Recommendation
Update FortiOS and FortiProxy to the latest patched versions. Restrict access to management interfaces where possible.
Other vulnerabilities in FortiOS / FortiProxy
See all- CVE-2026-84393High
A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via <insert attack vector here>
- CVE-2025-54822Medium
An improper authorization vulnerability (CWE-285) in Fortinet FortiOS and FortiProxy allows an authenticated attacker to access static files of other VDOMs via crafted HTTP or HTTPS requests. Affects multiple versions of FortiOS (7.4.0-7.4.1, 7.2.0-7.2.8, 7.0.0-7.0.11) and FortiProxy (7.4.0-7.4.8, 7.2, 7.0, 2.0).
- CVE-2023-22640High
An out-of-bounds write vulnerability in Fortinet FortiOS and FortiProxy allows an authenticated attacker to execute unauthorized code or commands via specifically crafted requests.
- CVE-2022-42476High
A relative path traversal vulnerability (CWE-23) in Fortinet FortiOS (7.2.0–7.2.3, 7.0.0–7.0.8, 6.4.0–6.4.11, 6.2.0–6.2.12) and FortiProxy (7.2.0–7.2.1, 7.0.0–7.0.7, 2.0.0–2.0.11, 1.2, 01.02, 1.1, 01.01) allows privileged VDOM administrators to escalate to super admin via crafted CLI requests.
- CVE-2022-42472Medium
Fortinet FortiOS and FortiProxy contain an improper neutralization of CRLF sequences in HTTP headers (HTTP response splitting). An authenticated remote attacker can perform an HTTP request splitting attack, gaining control of the remaining headers and body of the response.
Original NVD description (English source)
A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests
Vulnerability data from NVD (NIST) · CISA KEV · EPSS