Article
Two Fortinet events of 2026: what to check
Fortinet had two 2026 events: a January SSO login flaw and a June wave of leaked logins. See what a firewall owner checks, from…
Read more
Exploited vulnerability
FortiOS SSL VPN out-of-bounds write (CVE-2024-21762)
CVE-2024-21762
CVE-2024-21762 is an out-of-bounds write flaw in the SSL VPN service of FortiOS and in FortiProxy.
- On CISA KEV
- CVE ID
- CVE-2024-21762
- CISA KEV
- Listed
- Affected product
- FortiOS (SSL VPN) and FortiProxy
- Exploited
- Yes
- Published
- February 2024
In short
CVE-2024-21762 is an out-of-bounds write flaw in the SSL VPN service of FortiOS and in FortiProxy. Fortinet says a remote attacker with no login may run code or commands through specially crafted HTTP requests. Fortinet noted it was potentially being exploited, and CISA added it to its exploited vulnerabilities list on 9 February 2024.
- CVECVE-2024-21762
- ProductFortinet FortiOS (SSL VPN) and FortiProxy
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedUpgrade FortiOS · Upgrade FortiProxy
What it allows
A remote attacker who has no account can send crafted HTTP requests to the device and execute code or commands on it. An out-of-bounds write means the software writes data outside the memory it was given, which an attacker can turn into code execution. NVD scores it 9.8 (critical) with network access, low complexity, no privileges and no user interaction needed. Fortinet's own score is 9.6.
Who is affected
Fortinet lists FortiOS 7.4.0 to 7.4.2, 7.2.0 to 7.2.6, 7.0.0 to 7.0.13, 6.4.0 to 6.4.14, 6.2.0 to 6.2.15 and 6.0.0 to 6.0.17. It also lists FortiProxy 7.4.0 to 7.4.2, 7.2.0 to 7.2.8, 7.0.0 to 7.0.14, 2.0.0 to 2.0.13, and all versions of 1.2, 1.1 and 1.0. The advisory is titled as an out-of-bounds write in sslvpnd, the SSL VPN daemon.
Fortinet published its advisory on 8 February 2024 and noted that the flaw was potentially being exploited in the wild. NVD published the entry and CISA added CVE-2024-21762 to the Known Exploited Vulnerabilities catalog on 9 February 2024, with a due date of 16 February 2024 for US federal agencies. We found no government advisory in our checks that names a group using it, so no group is linked here.
What to do
-
Upgrade FortiOS
Fortinet names the fixed releases: FortiOS 7.4.3, 7.2.7, 7.0.14, 6.4.15, 6.2.16 and 6.0.18, or any later version in the same branch.
-
Upgrade FortiProxy
Fortinet names the fixed FortiProxy releases: 7.4.3, 7.2.9, 7.0.15 and 2.0.14 or later. FortiProxy 1.x has no fixed release listed, so plan a move to a supported branch.
-
Disable SSL VPN if you cannot patch
Fortinet gives one workaround: disable SSL VPN. It states that disabling only the web mode is not a valid workaround.
-
Follow the CISA required action
CISA's catalog says to apply mitigations per vendor instructions, or stop using the product if mitigations are not available.
-
Check for signs of misuse
If an unpatched SSL VPN was reachable from the internet, review the device for unexpected admin accounts, config changes and new VPN users. This is general practice, not a step from the Fortinet advisory.
Questions
What is CVE-2024-21762?
It is an out-of-bounds write flaw in FortiOS SSL VPN and FortiProxy. Fortinet says a remote attacker with no account can run code or commands by sending specially crafted HTTP requests.
Which FortiOS versions are fixed?
Fortinet names the fixed releases 7.4.3, 7.2.7, 7.0.14, 6.4.15, 6.2.16 and 6.0.18, or any later version in the same branch. Fortinet lists affected FortiOS from 6.0.0 up to 7.4.2, so check your branch against the advisory.
Is there a workaround for CVE-2024-21762?
Yes, one: disable SSL VPN. Fortinet states that disabling only the web mode is not a valid workaround, so turn off SSL VPN fully if you cannot patch.
Is CVE-2024-21762 exploited in the wild?
Fortinet noted on 8 February 2024 that it was potentially being exploited. CISA added it to the Known Exploited Vulnerabilities catalog on 9 February 2024, with a due date of 16 February for US federal agencies.
Does it affect FortiProxy?
Yes. Fortinet lists FortiProxy 7.4.0 to 7.4.2, 7.2.0 to 7.2.8, 7.0.0 to 7.0.14, 2.0.0 to 2.0.13 and all 1.x versions. Fixed releases are 7.4.3, 7.2.9, 7.0.15 and 2.0.14.
How severe is CVE-2024-21762?
NVD scores it 9.8 and Fortinet scores it 9.6, both critical. No login or user action is needed, only network access to the SSL VPN.
In our research
- Two Fortinet events of 2026: what to check October 2026
- Volt Typhoon advisory AA24-038A: what CISA says October 2026
- KEV due-date windows and pace of additions October 2026
- KEV and ransomware: which entries are flagged October 2026
Sources
- FG-IR-24-015 FortiOS out-of-bounds write in sslvpnd Fortinet PSIRT
- NVD entry CVE-2024-21762 NIST National Vulnerability Database
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.