CVE-2024-26008

Medium5.3 Published on Oct 14, 2025

An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version 7.4.0 through 7.4.3 and before 7.2.9, FortiPAM before 1.2.0 and FortiSwitchManager version 7.2.0 through 7.2.3 and version 7.0.0 through 7.0.3 fgfm daemon may allow an unauthenticated attacker to repeatedly reset the fgfm connection via crafted SSL encrypted TCP requests.

CVSS score5.3 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness type (CWE)CWE-754

Vendorsfortinet

Affected products

Vendors	Product	Versions
fortinet	fortios	< 7.2.8
fortinet	fortipam	< 1.3.0
fortinet	fortiproxy	< 7.2.10
fortinet	fortiswitchmanager	< 7.0.4

APT

Fortinet flaws enabled telecom intrusion and memory-resident PeerStitch implant

Palo Alto Networks reports suspected state-backed UNC5820 exploited Fortinet flaws to breach FortiManager and deploy in-memory PeerStitch on FortiGate.

Oct 19, 202612:31 5 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

CVE-2024-26008

Affected products

Related articles

Fortinet flaws enabled telecom intrusion and memory-resident PeerStitch implant

Audience measurement