CVE-2024-47575: FortiManager missing authentication allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable remote code execution with a 9.8 CVSS score, active KEV listing, and near-maximum EPSS probability.

What it is

FortiManager and FortiManager Cloud contain a missing authentication flaw in a critical function, letting specially crafted requests execute arbitrary code or commands. Because the affected component is reachable over the network without credentials, it is a high-value target for initial access into managed firewall estates.

Impact

An unauthenticated attacker can run arbitrary code or commands on the FortiManager appliance, gaining control of the system that centrally manages FortiGate devices and their policies.

Attack surface

Reachable over the network via crafted requests to the affected critical function; the CVSS vector shows no privileges and no user interaction required.

Exploitation

CISA added it to KEV on 2024-10-23 with a remediation due date of 2024-11-13, and EPSS gives a 30-day probability of 0.9507 (99.859th percentile); the vendor advisory is tagged Exploit.

What to do

• Apply the Fortinet FortiManager and FortiManager Cloud updates referenced in FG-IR-24-423 immediately.
• If patching cannot be completed by the KEV due date, restrict management interface access to trusted networks or discontinue use per CISA guidance.
• Block or tightly filter internet exposure of FortiManager management ports and administrative services.
• Review and rotate credentials and certificates stored or managed by FortiManager after any suspected compromise.
• Monitor Fortinet PSIRT and CISA KEV for updated mitigation guidance.

Detection

• Hunt for unexpected or anomalous requests to FortiManager management endpoints, especially from untrusted source IPs.
• Review FortiManager logs for unusual process execution, new files, or configuration changes on the appliance.
• Alert on outbound connections from FortiManager to unknown external hosts that could indicate post-exploitation activity.
• Correlate FortiManager access logs with downstream FortiGate configuration changes for signs of tampering.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.