CVE-2024-47575

Critical9.8 Published on Oct 23, 2024

A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Oct 23, 2024
US federal agencies must remediate it by Nov 13, 2024 (BOD 22-01)
Attacked 1 day before the vulnerability was made public

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Source: CISA KEV · Oct 14, 2026 Aug 26, 2026 Apr 25, 2025 Apr 23, 2025 Apr 23, 2025 Apr 3, 2025

CVSS score9.8 / 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness type (CWE)CWE-306

Vendorsfortinet

Affected products

Vendors	Product	Versions
fortinet	fortimanager	< 6.2.13
fortinet	fortimanager cloud	<= 6.4.7

APT

Fortinet flaws enabled telecom intrusion and memory-resident PeerStitch implant

Palo Alto Networks reports suspected state-backed UNC5820 exploited Fortinet flaws to breach FortiManager and deploy in-memory PeerStitch on FortiGate.

Oct 19, 202612:31 5 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database