CVE-2024-23113: Fortinet FortiOS and related products format string remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network exploitation, KEV listing and very high EPSS make this an urgent edge-device vulnerability.

What it is

A use of externally-controlled format string (CWE-134) in Fortinet FortiOS, FortiProxy, FortiPAM and FortiSwitchManager lets an attacker execute unauthorized code or commands via specially crafted packets. The flaw is network-reachable with no authentication or user interaction, and it affects a wide range of firewall, proxy and management products, making it a serious edge-device risk.

Impact

An unauthenticated remote attacker can run arbitrary code or commands on the affected device, potentially gaining full control of the appliance and any traffic or credentials it handles.

Attack surface

Reachable over the network via crafted packets to the affected products, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.

Exploitation

Listed in CISA KEV with a 2024-10-30 remediation due date, and EPSS 30-day probability is 0.617 (99th percentile), indicating active exploitation and high likelihood. No ransomware campaign use is recorded.

What to do

• Apply the Fortinet vendor updates referenced in FG-IR-24-029 for all affected FortiOS, FortiProxy, FortiPAM and FortiSwitchManager versions.
• If patching is not immediately possible, follow CISA KEV required action and Fortinet mitigation guidance, or discontinue use of the affected product.
• Restrict management and service exposure of these appliances to trusted networks and disable unnecessary internet-facing interfaces.
• Inventory all affected Fortinet products and versions to confirm which remain unpatched.
• Monitor vendor advisory for updated fixed versions and re-check after patching.

Detection

• Monitor appliance and perimeter logs for anomalous or malformed packets targeting Fortinet management and service ports.
• Alert on unexpected process execution, command shells or configuration changes on Fortinet devices.
• Track outbound connections from Fortinet appliances to unknown hosts for signs of post-exploitation.
• Correlate device logs with CISA KEV and vendor advisory indicators for this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.