# Multiple Fortinet products vulnerable to remote code execution

Published: 2026-06-09 · Severity: high · Sectors: government-national, financial-services, defense
Canonical: https://vorant.io/reports/c636a60a-1e6b-5f6f-a6db-b944b954d81a/multiple-fortinet-products-vulnerable-to-remote-code-execution

> Multiple vulnerabilities in Fortinet management and security products allow remote code execution; CVE-2024-55591 was exploited in the wild in January 2025.

Fortinet has disclosed multiple vulnerabilities across its product portfolio, with the most critical affecting FortiManager, FortiAnalyzer, FortiSandbox, FortiOS, FortiProxy, FortiSwitchManager, and FortiPAM. The primary threats are authentication bypass vulnerabilities (CVE-2025-24472, CVE-2024-55591) that allow remote attackers to gain super-admin privileges via crafted requests to Node, and a stack-based buffer overflow in FortiOS CAPWAP control (CVE-2024-35279) that permits unauthenticated remote code execution through specially crafted UDP packets if fabric service is running on an exposed interface. CVE-2024-55591 was confirmed exploited in the wild during January 2025 but is no longer being actively exploited as of the February 12 update.

Additional lower-severity vulnerabilities include format string injection, path traversal, OS command injection, cross-site scripting, and sensitive information exposure flaws across multiple Fortinet products. Successful exploitation could allow attackers to execute arbitrary code in the context of the affected service account, with impact depending on service account privileges—administrative service accounts represent higher risk. The advisory affects multiple product versions ranging from legacy 6.2 releases through recent 7.6 versions.

Defenders should prioritize patching FortiOS and FortiProxy authentication bypass vulnerabilities and FortiOS CAPWAP buffer overflow issues immediately, particularly for internet-facing instances. Implementing network segmentation, least-privilege service account configurations, and vulnerability scanning is critical given the breadth of affected products and the confirmed prior exploitation.

## Mentioned in this report

- Vulnerabilities: CVE-2023-40721, CVE-2024-27781, CVE-2024-33504, CVE-2024-35279, CVE-2024-36508, CVE-2024-40584, CVE-2024-40585, CVE-2024-40591, CVE-2024-52966, CVE-2024-55591 (KEV), CVE-2025-24472 (KEV)

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-remote-code-execution_2025-017

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c636a60a-1e6b-5f6f-a6db-b944b954d81a/multiple-fortinet-products-vulnerable-to-remote-code-execution.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup