CVE-2024-21762: Fortinet FortiOS and FortiProxy out-of-bounds write in SSL VPN

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network reachability, CISA KEV listing with known ransomware use, and very high EPSS make this an urgent patch-first issue.

What it is

FortiOS and FortiProxy contain an out-of-bounds write (CWE-787) reachable through specifically crafted requests. The flaw affects a wide range of FortiOS and FortiProxy versions and can lead to unauthorized code or command execution. It is a critical, remotely reachable issue in widely deployed perimeter security appliances.

Impact

An unauthenticated remote attacker can execute unauthorized code or commands on the affected device. Because these are edge appliances, compromise can expose the internal network and enable further lateral movement.

Attack surface

Reachable over the network via crafted requests to the affected FortiOS/FortiProxy service, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.

Exploitation

CISA added it to the Known Exploited Vulnerabilities catalog on 2024-02-09 with a due date of 2024-02-16 and flags known ransomware campaign use; EPSS 30-day probability is 0.84285 (99.684th percentile), indicating active exploitation is expected.

What to do

• Apply the Fortinet vendor patches referenced in FG-IR-24-015 for all affected FortiOS and FortiProxy versions.
• If patching cannot be done immediately, follow CISA's required action and Fortinet's guidance, including disabling SSL VPN or applying available mitigations.
• Restrict management and SSL VPN interfaces from untrusted networks where operationally feasible.
• Rotate credentials and inspect for signs of compromise on any device that was exposed before patching.
• Track CISA KEV remediation due dates and confirm all internet-facing instances are updated.

Detection

• Monitor FortiGate/FortiProxy logs for abnormal or malformed requests to SSL VPN endpoints and for unexpected process crashes or restarts.
• Hunt for post-exploitation indicators such as new local accounts, modified SSL VPN configurations, or unexpected outbound connections from the appliance.
• Correlate appliance logs with network telemetry for command-and-control or lateral movement originating from the firewall/VPN device.
• Alert on unauthorized configuration changes or new administrative sessions on FortiOS/FortiProxy devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.