CVE-2024-26010

HighCVSS 7.5

Published: 11/06/2024(UTC)Updated: 22/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.79%

56th percentile - higher than 56% of all known CVEs

Summary

A stack-based buffer overflow vulnerability in multiple Fortinet products (FortiOS, FortiPAM, FortiProxy, FortiSwitchManager) allows an attacker to execute unauthorized code or commands via specially crafted packets.

Risk Assessment

This could lead to remote code execution and compromise of network devices, posing a serious threat to infrastructure security.

Recommendation

Update affected Fortinet products to the latest patched versions and restrict access to management interfaces.

Other vulnerabilities in Fortinet FortiOS/FortiPAM/FortiProxy/FortiSwitchManager

CVE-2023-45583Medium
A use of externally-controlled format string vulnerability exists in multiple Fortinet products (FortiOS, FortiPAM, FortiProxy, FortiSwitchManager). An attacker can execute unauthorized code or commands via specially crafted CLI commands and HTTP requests.

Original NVD description (English source)

A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.3, FortiOS 7.2.0 through 7.2.7, FortiOS 7.0.0 through 7.0.14, FortiOS 6.4 all versions, FortiOS 6.2 all versions, FortiOS 6.0 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9, FortiProxy 7.0.0 through 7.0.16, FortiProxy 2.0 all versions, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions, FortiSwitchManager 7.2.0 through 7.2.3, FortiSwitchManager 7.0.1 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS