External risk intelligence

Fortinet FortiOS FortiManager FortiProxy and FortiPAM Unauthorized Code Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-26011

This vulnerability affects various Fortinet edge infrastructure products, including FortiManager, FortiOS, and FortiProxy. These appliances are specifically designed to serve as internet-facing gateways, management surfaces, and security controllers, making them inherently reachable from the internet in common deployment scenarios.

Missing Authentication

Fortinet Fortios

6.0.0 to before 7.0.157.2.0 to before 7.2.87.4.0 to before 7.4.41.0.0 to before 1.3.01.0.0 to before 7.0.177.2.0 to before 7.2.106.4.0 to before 6.4.157.0.0 to before 7.0.127.2.0 to...

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in several Fortinet products, including FortiManager, FortiOS, and FortiProxy. This issue allows for unauthorized code or command execution through specially crafted network packets. The broad applicability across these core network security and management tools means understanding its relevance to our environment is important.

A critical flaw allows attackers to run unauthorized commands.
Leadership should remember this impacts core network security.
Confirm relevance and exposure to Fortinet products.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted network packets to exposed Fortinet devices. This could allow them to execute unauthorized code or commands on the targeted system, potentially leading to a full compromise.

Attacker sends malicious packets.
No authentication required for access.
Leads to unauthorized code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute unauthorized code or commands on affected Fortinet devices when they are reachable from the network. This could impact the integrity and availability of these network management and security appliances.

Network access to vulnerable devices.
Execution of arbitrary code or commands.
Compromise of network management functions.

Operational Fix

Recommended remediation, mitigation, and detection steps

Ownership for this critical vulnerability likely resides with teams managing Fortinet infrastructure, such as network security, infrastructure operations, or dedicated platform teams. The first actionable step is to immediately identify all instances of the affected Fortinet products, assess their external reachability and business criticality, and then confirm the accountable system owner to initiate a prioritized remediation plan.

Network or platform teams should own this.
Verify external exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FortiManager and the other affected Fortinet products?

These are core network security and management tools used to centralize control over infrastructure. FortiManager manages security policies across devices; FortiOS serves as the operating system for firewalls; FortiProxy acts as a web security gateway; and products like FortiPAM and FortiPortal provide privileged access management and multi-tenant portal services. Organizations rely on these to monitor, secure, and route traffic across their networks.

What does CWE-306 mean for CVE-2024-26011?

CWE-306 refers to 'Missing Authentication for Critical Function.' This means the software performs sensitive tasks without verifying the identity of the user or system requesting them. In the context of this CVE, it allows an unauthenticated attacker to bypass login requirements entirely, enabling them to execute unauthorized code or commands on the device simply by sending the right instructions over the network.

How do attackers trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted network packets directly to an affected device. Because the vulnerability exists in a function that lacks authentication, the device processes these malicious packets as legitimate commands. This does not require any prior access to the system, but the device must be reachable over the network to receive the packets.

Is my environment at risk from this CVE?

Halo Surface Signal identifies this as a significant concern because affected products like FortiManager and FortiOS are frequently deployed as internet-facing gateways. Since these devices are often intentionally placed at the network edge to manage security, they are highly reachable. If your instances are accessible from the internet, they are at a higher risk of being targeted by unauthorized network packets.

What steps should I take if I run these products?

First, create a complete inventory of all Fortinet appliances in your environment to identify versions matching the affected criteria. Prioritize confirming which devices are reachable from the internet, as these present the highest risk. Finally, coordinate with your network or infrastructure operations teams to verify ownership of these assets and initiate the necessary patching process to secure the management functions.

References

fortiguard.fortinet.com/psirt/FG-IR-24-032

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.