CVE-2024-21762: Fortinet FortiOS Out-of-Bound Write Vulnerability
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via…
Published Feb 9, 2024 · Updated Aug 4, 2026
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Fortinet vulnerabilities
All Fortinet entriesCVE-2026-104286
Fortinet FortiMail Path Traversal Vulnerability
critical9.8ExploitedOct 1, 2026CVE-2026-25089
Fortinet FortiSandbox OS Command Injection Vulnerability
critical9.8ExploitedJun 9, 2026CVE-2025-61624
Fortinet Multiple Products Path Traversal Vulnerability
medium6.5ExploitedApr 14, 2026CVE-2026-39808
Fortinet FortiSandbox OS Command Injection Vulnerability
critical9.8ExploitedApr 14, 2026CVE-2026-35616
Fortinet FortiClient EMS Improper Access Control Vulnerability
critical9.8ExploitedApr 4, 2026CVE-2025-68686
Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
medium5.9ExploitedFeb 10, 2026
