---
id: "CVE-2024-21762"
kind: "vulnerability"
aliases: ["CVE-2024-21762"]
title: "A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "fortinet fortiproxy", "fixed": ["2.0.14"], "affected": ">= 1.0.0, < 2.0.14", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": ["7.0.15"], "affected": ">= 7.0.0, < 7.0.15", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": ["7.2.9"], "affected": ">= 7.2.0, < 7.2.9", "ecosystem": "vendor"}, {"name": "fortinet fortiproxy", "fixed": ["7.4.3"], "affected": ">= 7.4.0, < 7.4.3", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["6.0.18"], "affected": ">= 6.0.0, < 6.0.18", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["6.2.16"], "affected": ">= 6.2.0, < 6.2.16", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["6.4.15"], "affected": ">= 6.4.0, < 6.4.15", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.0.14"], "affected": ">= 7.0.0, < 7.0.14", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.2.7"], "affected": ">= 7.2.0, < 7.2.7", "ecosystem": "vendor"}, {"name": "fortinet fortios", "fixed": ["7.4.3"], "affected": ">= 7.4.0, < 7.4.3", "ecosystem": "vendor"}, {"name": "Fortinet FortiOS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "fortigate", "fortios", "infrastructure", "ransomware", "vpn-appliance"]
not_affected_if: ["unknown"]
published_at: "2024-02-09T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-24T00:09:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-21762", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21762", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS…

Fortinet FortiOS, the firmware on FortiGate firewalls and VPN appliances, has an out-of-bounds write in its HTTP handling. A remote unauthenticated attacker can send crafted HTTP requests to execute code or commands on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:fortinet fortiproxy affected >= 1.0.0, < 2.0.14 fixed 2.0.14
- vendor:fortinet fortiproxy affected >= 7.0.0, < 7.0.15 fixed 7.0.15
- vendor:fortinet fortiproxy affected >= 7.2.0, < 7.2.9 fixed 7.2.9
- vendor:fortinet fortiproxy affected >= 7.4.0, < 7.4.3 fixed 7.4.3
- vendor:fortinet fortios affected >= 6.0.0, < 6.0.18 fixed 6.0.18
- vendor:fortinet fortios affected >= 6.2.0, < 6.2.16 fixed 6.2.16
- vendor:fortinet fortios affected >= 6.4.0, < 6.4.15 fixed 6.4.15
- vendor:fortinet fortios affected >= 7.0.0, < 7.0.14 fixed 7.0.14
- vendor:fortinet fortios affected >= 7.2.0, < 7.2.7 fixed 7.2.7
- vendor:fortinet fortios affected >= 7.4.0, < 7.4.3 fixed 7.4.3
- vendor:Fortinet FortiOS affected ? fixed ?

## Fix

Apply the mitigation or patch per Fortinet's vendor advisory, or discontinue use of the product if mitigations are unavailable (per CISA required action). Specific fixed versions: unknown

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-21762
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-21762

## From the sources

A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_