CVE-2024-21762: Fortinet FortiOS SSL-VPN RCE

CVE-2024-21762 is an out-of-bounds write in the SSL-VPN component (sslvpnd) of Fortinet FortiOS and FortiProxy that lets a remote, unauthenticated attacker execute arbitrary code or commands on the device via a crafted HTTP request, and it was exploited in the wild — including in ransomware intrusions — before most organizations could patch.

CVE-2024-21762 is an out-of-bounds write (CWE-787) in the sslvpnd component of Fortinet FortiOS and FortiProxy. A remote attacker who can reach the SSL-VPN interface, without needing any credentials, can send a specially crafted request that writes outside the bounds of an allocated buffer, leading to execution of unauthorized code or commands on the appliance (NVD).

NVD's own analysis and Fortinet's CNA-submitted score agree: CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, with high impact to confidentiality, integrity and availability (NVD).

CISA added CVE-2024-21762 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-02-09, with a required-action due date of 2024-02-16, and the catalog records known use in ransomware campaigns (CISA KEV).

Fortinet's own PSIRT advisory FG-IR-24-015 lists the FortiOS and FortiProxy builds above as affected, states that disabling SSL-VPN is the only workaround short of upgrading (disabling just "webmode" is explicitly called out as not a valid workaround), and notes a virtual patch (FortiGuard IPS signature "HTTP.Chunk.Length.Invalid.", available from FMWP database update 24.020) for appliances that cannot be patched immediately. The advisory states the issue is "potentially being exploited in the wild" (Fortinet PSIRT Advisory FG-IR-24-015).

As of 2026-10-20, FIRST scores the probability of exploitation at 0.8343 (99.683th percentile), consistent with a vulnerability that remains widely scanned and exploited years after disclosure (FIRST EPSS).

Because the only real remediation is patching (or fully disabling SSL-VPN), any FortiOS or FortiProxy device on an affected build with SSL-VPN enabled should be upgraded immediately and checked for signs of prior compromise given the documented ransomware use.

• Unauthenticated, remote out-of-bounds write in the sslvpnd component of FortiOS/FortiProxy allows execution of unauthorized code or commands via crafted requests. — NVD
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, agreed by both NVD and the Fortinet CNA submission. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2024-02-09, due date 2024-02-16, with known ransomware campaign use. — CISA KEV
• Affected: FortiOS 6.0.0-6.0.17, 6.2.0-6.2.15, 6.4.0-6.4.14, 7.0.0-7.0.13, 7.2.0-7.2.6, 7.4.0-7.4.2; FortiProxy 1.0.x-1.2.x and 2.0.0-2.0.13 (fixed 2.0.14), 7.0.0-7.0.14, 7.2.0-7.2.8, 7.4.0-7.4.2. Disabling SSL-VPN is the only workaround (disabling webmode alone is not valid); a virtual patch IPS signature exists for appliances pending upgrade. — Fortinet PSIRT Advisory FG-IR-24-015
• EPSS score is 0.8343 (99.683th percentile) as of 2026-10-20. — FIRST EPSS