Threats / Fortinet / CVE-2024-21762
CVE-2024-21762
· EUVD no mirror located
· GCVE no mirror located
Verified 2026-06-22
Fortinet FortiOS vulnerability
Fortinet FortiOS contains an out-of-bounds write vulnerability allowing remote unauthenticated attackers to execute arbitrary code via crafted HTTP requests. Actively exploited in ransomware campaigns.
Verdict
Today item, not a backlog item.
Critical remote code execution vulnerability in widely deployed network security appliances. No authentication required. High exploitation activity and ransomware integration indicate immediate threat to enterprise perimeters.
CISA KEV Yes · 2024-02-093Ransomware use Flagged3EPSS 0.80835 (verify live)4Exploit Weaponized · public PoC5
01
Is it exploitable?
— the evidence, ranked above the scoreExploit available
Fully weaponized — public exploit code is cataloged for this vulnerability.We link the existence of the exploit; we do not host or redistribute payloads.
Reported exploitation
65 independent public reports of in-the-wild exploitation are cataloged.Distinct reporting sources (vendor, incident response, government); open them for the underlying claims.
Exploited in the wild
Listed in the CISA Known Exploited Vulnerabilities catalog (added 2024-02-09), flagged for known ransomware use.
Probability (EPSS)
EPSS 0.80835 — modeled likelihood of exploitation activity.EPSS is a daily-changing model output — open the source for today's value.
Severity / affected
Affected: Fortinet, FortiOS. Confirm exact fixed builds in the vendor advisory.
Weakness (CWE)
Mapped to CWE-787 Out-of-bounds Write — weakness family: Memory safety.CWE assignment from the public NVD record; the weakness class drives how the flaw is exploited.
02
Who’s exploiting it?
— attribution turns risk into urgencyAttribution not established
No confirmed (advisory-backed) threat-actor attribution is established for this record. Absence of a named actor is not absence of compromise — see Coverage & confidence.
03
Why it matters
— the attack path, told twice: adversary, then board1
Front door — unauthenticated access narrative 1
Attacker
I craft malicious HTTP requests targeting the out-of-bounds write flaw to achieve code execution on exposed FortiOS instances.
Business
Attackers gain initial access to critical network infrastructure, bypassing perimeter defenses and establishing persistence.
2
Keys to the kingdom — privilege/identity takeover narrative 2
Attacker
I leverage code execution to deploy ransomware payloads or lateral movement tools across the victim network.
Business
Operations halt as ransomware encrypts business-critical systems; attackers demand payment while threatening data disclosure.
3
Lateral reach — past segmentation narrative 3
Attacker
I exfiltrate sensitive data and maintain backdoor access for future extortion or espionage.
Business
Regulatory fines, customer trust erosion, and prolonged recovery costs compound the direct ransom impact.
04
What to do
— defensible action- Remediate per the vendor advisory — confirm the fixed build for your version and verify exposure.1
Say it to the boardA vulnerability with this evidence profile is a defensible budget line, not a backlog ticket — fund the change against the proof above.
05