Update: Fortinet published another pair of critical security-appliance RCE advisories in 2026, covering FortiAuthenticator and FortiSandbox unauthenticated command-execution flaws. The same response pattern applies: patch quickly, then check whether management or web UI access was exposed.
A critical vulnerability in Fortinet was exploited in the wild. Although the attackers did not deploy malware, they managed to steal technical information about the devices.
New Fortinet Flaw Has Been Exploited
On October 23, 2024, Fortinet confirmed that a critical zero-day vulnerability in FortiManager has been actively exploited since late June 2024. The flaw, CVE-2024-47575, named FortiJump, has a CVSS score of 9.8, (critical), and allows attackers to connect to FortiManager servers without proper authentication.
As a result, the attacker gains unauthorized access to execute commands and steal configuration data from managed FortiGate devices. Over 50 FortiManager servers have reportedly been compromised, and it is only up to guesses how much the hackers have already breached or will breach in future.
This vulnerability first emerged after Fortinet privately alerted customers to suspicious activity, and Fortinet has confirmed CVE-2024-47575. According to Mandiant (the company that worked with Fortinet to investigate the incident), attackers used this flaw to exfiltrate data, such as device configurations and encrypted user credentials. Despite confirmed exploitation of this vulnerability, researchers found no direct evidence of malware deployment or lateral movement within compromised systems.
CVE-2024-47575 Technical Details
The CVE-2024-47575 vulnerability exists in the FortiGate-to-FortiManager (FGFM) API that FortiManager uses to manage FortiGate devices. This flaw arises from missing authentication checks in the fgfmd daemon, allowing an attacker with a valid Fortinet device certificate to register and connect to any exposed FortiManager server. Once connected, attackers can execute commands on both FortiManager and its connected FortiGate devices.
Exploitation begins with an attacker-controlled Fortinet device, which, even in an unauthorized state, can still communicate via the FGFM protocol. This setup providesserves as an entry point for attackers to retrieve sensitive configuration data, including FortiGate credentials and IP information.
Researchers have reported that an attacker identified as UNC5820 has attempted to exploit FortiManager devices twice since June 27, 2024. Although the stolen data poses risks of further exploitation, Mandiant observed that UNC5820 primarily focused on exfiltrating configuration data rather than moving laterally across networks.
What’s Next?
In its October 24, 2024 advisory, Censys reported 4,081 exposed FortiManager administrative portals, with about 30% in the United States. That was an exposure count, not a confirmed vulnerable-device count: Censys could not determine the specific versions. To address CVE-2024-47575, follow Fortinet’s advisory for the affected release branch; fixed versions include 7.0.13, 7.2.8, 7.4.5, and 7.6.1 or later in the corresponding branch. These fixed releases are distinct from the minimum versions that support the unknown-device registration workaround.
Fortinet also recommends setting up IP allow-lists to control device connections and using the command “set fgfm-deny-unknown enable” to prevent unauthorized devices from accessing FortiManager.
Additional guidance includes configuring custom certificates (available from version 7.2.2 onward) and restricting public access to FortiManager’s admin portals. In addition, it is recommended to check access logs for suspicious activity.
Given the high risk associated with this vulnerability, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included CVE-2024-47575 in its Known Exploited Vulnerabilities catalog, urging federal agencies to apply these patches by November 13, 2024.
Fortinet perimeter exposure also appears in the joint CISA/FBI Gunra ransomware advisory, which links CVE-2024-55591 and CVE-2025-24472 to initial access and a malicious forticloud-sync account.
October 17, 2026 follow-up: A later Unit 42 investigation traced the theft of management trust into credential reuse and PEERSTITCH inside FortiGate logging and VPN processes. The newer report distinguishes exposure of 500+ firewall configurations from confirmed intrusion into client networks, and explains why patching alone does not revoke stolen keys.
References
- Fortinet, FortiGuard Labs. Missing authentication in fgfmsd (FG-IR-24-423). Published October 23, 2024; updated November 27, 2024. Accessed October 18, 2026.
- Censys. October 24 Advisory: Zero day in Fortinet FortiManager seeing Active Exploitation [CVE-2024-47575]. October 24, 2024. Accessed October 18, 2026.
