CVE-2024-47575: Fortinet FortiManager Missing Authentication Vulnerability

Actively exploited: added to CISA’s KEV catalog on October 23, 2024.
Use by ransomware: not established so far.
Remediation deadline for US federal agencies: November 13, 2024.

Description from CISA’s KEV catalog.

Our analyses

Fortinet: a flaw patched in April was used to hide an implant deep inside FortiGate firewalls

On October 16, CISA added CVE-2025-61624 to its list of exploited vulnerabilities. Here is what the attackers did according to Unit 42, which versions to install and what to look for on your devices.

Oct 17, 20262 min read

What to do

Check whether your estate includes Fortinet FortiManager, including internet-facing devices.
Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.

References

Vendor advisory or reference cited by CISA (fortiguard.fortinet.com)
NVD entry (NIST)
CISA KEV catalog

Other Fortinet vulnerabilities

All exploited Fortinet vulnerabilities

CVE-2024-47575: Fortinet FortiManager Missing Authentication Vulnerability

Our analyses

Fortinet: a flaw patched in April was used to hide an implant deep inside FortiGate firewalls

What to do

References

Other Fortinet vulnerabilities

Fortinet Multiple Products Path Traversal Vulnerability

Fortinet FortiMail Path Traversal Vulnerability

Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability

Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Fortinet FortiSandbox OS Command Injection Vulnerability

Fortinet FortiSandbox OS Command Injection Vulnerability