CVE-2024-47575
KEVCRITICAL 9.8EPSS 94.8%
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.
- Affected
- Fortinet · FortiManager
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 94.77% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2024-10-23
- Nuclei
- critical · CWE-306
- Published
- 2024-10-23
- Updated
- 2025-10-21
Proof-of-concept exploits (4)
- AnnnNix/CVE-2024-475750★ · 2025-07-19
- revanslbw/CVE-2024-47575-POC0★ · 2025-01-05
- watchtowrlabs/Fortijump-Exploit-CVE-2024-4757597★ · 2024-11-14
- 1337or420/FortiGate-FortiWeb-Multi-Exploit-Extractor2★ · 2026-09-17