{"id":"CVE-2024-21762","published":"2024-02-09T09:15:08Z","modified":"2026-10-22T19:20:41Z","title":"Fortinet FortiOS Out-of-Bound Write Vulnerability","vendor":"Fortinet","product":"FortiOS","tier":"core","eol":null,"description":{"text":"A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests","provenance":"source","from":"NVD"},"summary":{"text":"A out-of-bounds write flaw in Fortinet FortiOS (across the 6.0, 6.2, 6.4, 7.0, 7.2 and 7.4 release lines) and FortiProxy (across its 1.x, 2.0, 7.0, 7.2 and 7.4 lines) lets an attacker execute unauthorized code or commands by sending specifically crafted requests. Per the attack vector, this is reachable over the network with low complexity and no privileges or user interaction required, and the scope is unchanged.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:02:14Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.84589,"percentile":0.99702,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-02-09","dueDate":"2024-02-16","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015 ;   https://nvd.nist.gov/vuln/detail/CVE-2024-21762","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-02-08","exploitedFirstSeen":"2024-02-08","ransomware":true,"evidence":[{"url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","date":"2024-02-08"},{"url":"https://www.cisa.gov/news-events/alerts/2024/02/09/fortinet-releases-security-advisories-fortios","date":"2024-02-09"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-02-09"},{"url":"https://www.tenable.com/blog/cve-2024-21762-critical-fortinet-fortios-out-of-bound-write-ssl-vpn-vulnerability","date":"2024-02-09"},{"url":"https://www.threatmate.com/post/fortinet-vpn-targeted-by-chinese-actor-volt-typhoon-attacks","date":"2024-02-11"},{"url":"https://www.rapid7.com/blog/post/2024/02/12/etr-critical-fortinet-fortios-cve-2024-21762-exploited/","date":"2024-02-12"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-18&host_type=src&vulnerability=cve-2024-21762","date":"2024-03-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-19&host_type=src&vulnerability=cve-2024-21762","date":"2024-03-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-20&host_type=src&vulnerability=cve-2024-21762","date":"2024-03-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-21&host_type=src&vulnerability=cve-2024-21762","date":"2024-03-21"}],"evidenceTotal":74,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"https://fortiguard.com/psirt/FG-IR-24-015","tags":["Vendor Advisory"]},{"url":"https://fortiguard.com/psirt/FG-IR-24-015","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21762","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Out-of-Bounds (Read and Write)","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability allows adversaries to execute arbitrary code via specially crafted http requests that trigger an out of bounds write. Threat actors have been observed implementing a symbolic link, left behind to maintain read-only access to impacted devices.","confidence":"high"},{"id":"T1574","name":"Hijack Execution Flow","tactics":["execution","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Out-of-Bounds (Read and Write)","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability allows adversaries to execute arbitrary code via specially crafted http requests that trigger an out of bounds write. Threat actors have been observed implementing a symbolic link, left behind to maintain read-only access to impacted devices.","confidence":"high"},{"id":"T1547.009","name":"Shortcut Modification","tactics":["persistence","privilege-escalation"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Out-of-Bounds (Read and Write)","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability allows adversaries to execute arbitrary code via specially crafted http requests that trigger an out of bounds write. Threat actors have been observed implementing a symbolic link, left behind to maintain read-only access to impacted devices.","confidence":"low","confidenceNote":"Windows-only technique on a non-Windows product"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-19376","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-19376","exploited":true,"exploitedSince":"2024-02-09","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":11,"skipped":3,"earliest":"2024-02-28","earliestUrl":"https://github.com/BishopFox/cve-2024-21762-check","repos":[{"name":"h4x0r-dz/CVE-2024-21762","url":"https://github.com/h4x0r-dz/CVE-2024-21762","stars":150,"created":"2024-03-13"},{"name":"BishopFox/cve-2024-21762-check","url":"https://github.com/BishopFox/cve-2024-21762-check","stars":107,"created":"2024-02-28"},{"name":"r4p3c4/CVE-2024-21762-Exploit-PoC-Fortinet-SSL-VPN-Check","url":"https://github.com/r4p3c4/CVE-2024-21762-Exploit-PoC-Fortinet-SSL-VPN-Check","stars":16,"created":"2024-03-13"},{"name":"d0rb/CVE-2024-21762","url":"https://github.com/d0rb/CVE-2024-21762","stars":12,"created":"2024-03-17"},{"name":"abrewer251/CVE-2024-21762_FortiNet_PoC","url":"https://github.com/abrewer251/CVE-2024-21762_FortiNet_PoC","stars":4,"created":"2025-05-22"}]},"first":{"date":"2024-02-28","source":"PoC-in-GitHub","url":"https://github.com/BishopFox/cve-2024-21762-check"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1574"],"provenance":"source"},{"stage":"related","techniques":["T1547.009"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2024-02-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://fortiguard.fortinet.com/psirt/FG-IR-24-015","provenance":"source"},{"date":"2024-02-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21762","provenance":"source"},{"date":"2024-02-09","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-02-09","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-19376","provenance":"source"},{"date":"2024-02-28","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/BishopFox/cve-2024-21762-check","provenance":"source"}],"speed":{"daysToPublicExploit":19,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 995 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9970"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"11 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-fortinet-fortios-cwe-787"}}