CVE-2024-21762 is an out-of-bounds write in the SSL-VPN component (sslvpnd) of Fortinet FortiOS and FortiProxy that lets a remote, unauthenticated attacker execute arbitrary code or commands on the device via a crafted HTTP request, and it was exploited in the wild — including in ransomware intrusions — before most organizations could patch.
Vulnerability summary
CVSS base score
9.8
Critical severity
EPSS score (FIRST)
83.4%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
Yes
Listed as known exploited
Published
Vulnerability ID: CVE-2024-21762 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Fortinet FortiOS | cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:* | 6.0.0 through 6.0.17 (fixed in 6.0.18); 6.2.0 through 6.2.15 (fixed in 6.2.16); 6.4.0 through 6.4.14 (fixed in 6.4.15); 7.0.0 through 7.0.13 (fixed in 7.0.14); 7.2.0 through 7.2.6 (fixed in 7.2.7); 7.4.0 through 7.4.2 (fixed in 7.4.3) |
| Fortinet FortiProxy | cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:* | 1.0.0 through 1.0.7, 1.1.0 through 1.1.6, 1.2.0 through 1.2.13, 2.0.0 through 2.0.13 (all fixed in 2.0.14); 7.0.0 through 7.0.14 (fixed in 7.0.15); 7.2.0 through 7.2.8 (fixed in 7.2.9); 7.4.0 through 7.4.2 (fixed in 7.4.3) |
What does this mean for affected devices?
CVE-2024-21762 is an out-of-bounds write (CWE-787) in the sslvpnd component of Fortinet FortiOS and FortiProxy. A remote attacker who can reach the SSL-VPN interface, without needing any credentials, can send a specially crafted request that writes outside the bounds of an allocated buffer, leading to execution of unauthorized code or commands on the appliance (NVD).
NVD's own analysis and Fortinet's CNA-submitted score agree: CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, with high impact to confidentiality, integrity and availability (NVD).
CISA added CVE-2024-21762 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-02-09, with a required-action due date of 2024-02-16, and the catalog records known use in ransomware campaigns (CISA KEV).
Fortinet's own PSIRT advisory FG-IR-24-015 lists the FortiOS and FortiProxy builds above as affected, states that disabling SSL-VPN is the only workaround short of upgrading (disabling just "webmode" is explicitly called out as not a valid workaround), and notes a virtual patch (FortiGuard IPS signature "HTTP.Chunk.Length.Invalid.", available from FMWP database update 24.020) for appliances that cannot be patched immediately. The advisory states the issue is "potentially being exploited in the wild" (Fortinet PSIRT Advisory FG-IR-24-015).
As of 2026-10-20, FIRST scores the probability of exploitation at 0.8343 (99.683th percentile), consistent with a vulnerability that remains widely scanned and exploited years after disclosure (FIRST EPSS).
Because the only real remediation is patching (or fully disabling SSL-VPN), any FortiOS or FortiProxy device on an affected build with SSL-VPN enabled should be upgraded immediately and checked for signs of prior compromise given the documented ransomware use.
Evidence
- Unauthenticated, remote out-of-bounds write in the sslvpnd component of FortiOS/FortiProxy allows execution of unauthorized code or commands via crafted requests. — NVD
- CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, agreed by both NVD and the Fortinet CNA submission. — NVD
- Added to the CISA Known Exploited Vulnerabilities catalog on 2024-02-09, due date 2024-02-16, with known ransomware campaign use. — CISA KEV
- Affected: FortiOS 6.0.0-6.0.17, 6.2.0-6.2.15, 6.4.0-6.4.14, 7.0.0-7.0.13, 7.2.0-7.2.6, 7.4.0-7.4.2; FortiProxy 1.0.x-1.2.x and 2.0.0-2.0.13 (fixed 2.0.14), 7.0.0-7.0.14, 7.2.0-7.2.8, 7.4.0-7.4.2. Disabling SSL-VPN is the only workaround (disabling webmode alone is not valid); a virtual patch IPS signature exists for appliances pending upgrade. — Fortinet PSIRT Advisory FG-IR-24-015
- EPSS score is 0.8343 (99.683th percentile) as of 2026-10-20. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
Is simply disabling 'webmode' enough to mitigate CVE-2024-21762 without a full patch?
No — Fortinet's PSIRT advisory FG-IR-24-015 explicitly states that disabling webmode alone is not a valid workaround for CVE-2024-21762; fully disabling SSL-VPN (or upgrading) is the only mitigation the advisory recognizes as effective, per Fortinet PSIRT Advisory FG-IR-24-015.
Is there a virtual patch for CVE-2024-21762 for appliances that can't be upgraded immediately?
Yes — Fortinet's advisory names a FortiGuard IPS signature, "HTTP.Chunk.Length.Invalid.", available from FMWP database update 24.020, as a virtual patch for appliances pending a full firmware upgrade, per Fortinet PSIRT Advisory FG-IR-24-015.
How did Fortinet characterize exploitation status of CVE-2024-21762 at disclosure?
Fortinet's own advisory described the issue as "potentially being exploited in the wild" at the time of disclosure, language the company used the same day CISA's KEV listing confirmed active, in-the-wild use, per Fortinet PSIRT Advisory FG-IR-24-015.
Do NVD and Fortinet agree on the severity of CVE-2024-21762?
Yes — unlike several other advisories on this site where the CNA and NVD scores diverge, NVD's own analysis and Fortinet's CNA-submitted score for CVE-2024-21762 agree exactly: CVSS v3.1 9.8 (critical), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, per NVD.
Questions about this page?