CVE-2024-47575: FortiManager Missing Authentication

CVE-2024-47575, publicly nicknamed "FortiJump", is a missing-authentication vulnerability in the fgfmd daemon of Fortinet FortiManager that lets a remote, unauthenticated attacker execute arbitrary code or commands via crafted requests, and Fortinet confirms it has been exploited in the wild, including automated exfiltration of managed-device credentials and configurations.

CVE-2024-47575 is a missing-authentication-for-critical-function vulnerability (CWE-306) in the fgfmd daemon of Fortinet FortiManager — the component that handles the FortiGate-to-FortiManager (FGFM) protocol used to manage fleets of FortiGate devices. A remote attacker who can reach this daemon, without needing any credentials, can send specially crafted requests that result in execution of arbitrary code or commands on the FortiManager instance (NVD).

NVD's primary analysis and Fortinet's own PSIRT-submitted score agree: CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, high impact to confidentiality, integrity and availability (NVD).

Fortinet's PSIRT advisory FG-IR-24-423, "Missing authentication in fgfmsd", lists the FortiManager and FortiManager Cloud builds above as affected and the corresponding fixed releases, and states plainly that "reports have shown this vulnerability to be exploited in the wild." The advisory describes attackers automating exfiltration of files from compromised FortiManager instances containing the IP addresses, credentials and configurations of every FortiGate device the instance manages — a significant lateral-movement risk given FortiManager's central role in multi-device estates. Workarounds short of patching include enabling "deny unknown FortiGate devices", restricting connections with local-in policies to a whitelist of known FortiGate IPs, or requiring custom certificates for FGFM connections (Fortinet PSIRT Advisory FG-IR-24-423).

CISA added CVE-2024-47575 to the Known Exploited Vulnerabilities (KEV) catalog on 2024-10-23 — the same day as initial disclosure — with a required action to apply vendor mitigations or discontinue use, and a due date of 2024-11-13. As of this check, the KEV catalog's "Known To Be Used in Ransomware Campaigns" field for this CVE reads "Unknown" — this page does not claim ransomware use beyond that (CISA KEV).

As of 2026-10-20, FIRST scores the probability of exploitation at 0.9477 (99.86th percentile), consistent with a vulnerability in a central management product that remains an attractive, widely scanned target (FIRST EPSS).

Any FortiManager or FortiManager Cloud instance on an affected build should be upgraded to the fixed release immediately; given the confirmed in-the-wild exfiltration of managed-device credentials, any instance that was internet-reachable on a vulnerable build before patching should also be checked for compromise and its managed FortiGate devices' credentials rotated.

• Missing authentication for a critical function in the fgfmd daemon of FortiManager allows a remote, unauthenticated attacker to execute arbitrary code or commands via crafted requests. — NVD
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, agreed by both NVD and the Fortinet PSIRT submission. — NVD
• Affected: FortiManager 6.2.0-6.2.12, 6.4.0-6.4.14, 7.0.0-7.0.12, 7.2.0-7.2.7, 7.4.0-7.4.4, 7.6.0 and FortiManager Cloud equivalents; fixed in 6.2.13, 6.4.15, 7.0.13, 7.2.8, 7.4.5, 7.6.1 respectively. Confirmed exploited in the wild, with automated exfiltration of managed-device credentials and configurations. — Fortinet PSIRT Advisory FG-IR-24-423
• Added to the CISA Known Exploited Vulnerabilities catalog on 2024-10-23, due date 2024-11-13; "Known To Be Used in Ransomware Campaigns" field reads "Unknown". — CISA KEV
• EPSS score is 0.9477 (99.86th percentile) as of 2026-10-20. — FIRST EPSS