Fortinet FortiManager Unauthenticated Remote Code Execution Vulnerability (CVE-2024-47575) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTMultiple versions of FortiManager and FortiManager Cloud (7.6.0, 7.4.0-7.4.4, 7.2.0-7.2.7, 7.0.0-7.0.12, 6.4.0-6.4.14, 6.2.0-6.2.12, etc.)
An unauthenticated remote attacker can execute arbitrary code or system commands via specially crafted requests, potentially leading to full system compromise
Immediately upgrade to the official patched versions or apply workarounds to restrict unauthorized FGFM connections
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security patches immediately. You can perform the firmware upgrade via the FortiManager CLI as shown below:
# Download and restore firmware image via FTP/HTTPS
execute restore image ftp /path/to/image/FMG_7.4.5.out 192.168.1.99 anonymous ''
# Or upgrade directly via HTTPS
execute restore image https 192.168.1.99/FMG_7.4.5.out2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, disable the automatic registration of unauthorized devices and restrict FGFM access to trusted IP addresses:
# Disable automatic registration of unknown devices
config system global
set register-device-by-ip disable
end
# Restrict administrative and FGFM access to trusted subnets
config system admin iplimitation
edit 1
set ip 10.0.0.0 255.0.0.0
next
end3. Log Audit & IoC Verification Commands
Audit FortiManager system logs to detect unauthorized connection attempts or suspicious tunnel establishments:
# Filter and display logs related to FGFM connections
show system log filter
execute log filter category event
execute log filter field subtype system
execute log display | grep -i 'fgfm'Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (commonly referred to as 'FortiJump') resides in the FortiGate-to-FortiManager (FGFM) protocol of FortiManager. Due to a missing authentication for a critical function (CWE-306), an unauthenticated attacker can establish a connection to the FGFM service (default TCP port 541) without valid administrative credentials.
2. Exploitation Mechanics & Attack Scenario
An attacker can use an unauthorized FortiGate device or a simulated client to initiate an FGFM connection to the target FortiManager. Because the FortiManager fails to properly verify the identity of the connecting device, the attacker can send specially crafted requests to execute arbitrary commands on the FortiManager or manipulate managed FortiGate devices.
3. Infrastructure & Business Impact
FortiManager serves as the centralized management hub for an organization's entire network security infrastructure. Compromising this appliance allows attackers to alter security policies, intercept sensitive network traffic, and pivot deeper into internal networks, posing an existential threat to business operations and data confidentiality.
Official Vendor Advisories & References
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.
Frequently Asked SecOps Questions (CVE-2024-47575)
FAQQ1. How critical is CVE-2024-47575 and is it actively exploited in the wild?
CVE-2024-47575 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 94.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-47575?
Primary impacted vendors include fortinet across fortimanager, fortimanager cloud. Scope summary: FortiManager 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.7, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, 6.2.0 through 6.2.12, and FortiManager Cloud 7.4.1 through 7.4.4, 7.2.1 through 7.2.7, 7.0.1 through 7.0.12, 6.4.1 through 6.4.7
Q3. What temporary mitigations or workarounds exist for CVE-2024-47575 before patching?
[Mitigation] Immediately upgrade to the official patched versions or apply workarounds to restrict unauthorized FGFM connections Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-47575
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (fortinet)
View Category →Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) - Unauthenticated Arbitrary File Write
[Affected Scope] FortiMail versions 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9, and all 7.0 versions.
Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-25089) Security Advisory
[Affected Scope] Fortinet FortiSandbox (5.0.0 to 5.0.5, 4.4.0 to 4.4.8, 4.2 all versions), FortiSandbox Cloud and PaaS (5.0.4 to 5.0.5)
Fortinet FortiSandbox OS Command Injection Vulnerability (CVE-2026-39808) Advisory
[Affected Scope] Fortinet FortiSandbox versions 4.4.0 through 4.4.8
Fortinet FortiClientEMS Remote Code Execution (RCE) Vulnerability via Improper Access Control (CVE-2026-35616)
[Affected Scope] Fortinet FortiClientEMS versions 7.4.5 through 7.4.6
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.