Article
Why CVSS Scores Are Lying to Your Security Team (And What to Use Instead)
CVSS scores show worst-case severity, not attacker behavior. See how EPSS, the CISA KEV catalog and SSVC help you decide which flaws to fix…
Read more
Exploited vulnerability
FortiManager missing authentication (CVE-2024-47575)
A missing authentication flaw in the FortiManager service that talks to managed firewalls.
- On CISA KEV
- CVE ID
- CVE-2024-47575
- CVSS
- 9.8 Critical (CVSS v3.1, Fortinet and NVD)
- CISA KEV
- Listed
- Affected product
- FortiManager and FortiManager Cloud
- Exploited
- 23 October 2024 (CISA KEV listing and Fortinet advisory publication)
- Published
- October 2024
In short
CVE-2024-47575 is a missing authentication flaw in the FortiManager service that talks to managed firewalls. A remote attacker with no login can run code or commands. CISA lists it as exploited, and Fortinet says reports show attacks in the wild.
- CVECVE-2024-47575
- ProductFortinet FortiManager and FortiManager Cloud
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedUpgrade FortiManager · Block unknown devices
What it allows
A remote attacker who is not logged in can send crafted requests to FortiManager and run arbitrary code or commands. Fortinet and NVD both score it 9.8 on CVSS v3.1, with no privileges and no user action needed. In its advisory Fortinet describes attacks that automated the theft of files from FortiManager, including IP addresses, credentials and the configuration of managed devices. At the time the advisory said no malware or backdoors had been reported. In October 2026 Palo Alto Networks Unit 42 reported that attackers used this flaw for first access in an intrusion against a telecommunications managed service provider and later ran in-memory malware on FortiOS devices (see the PEERSTITCH page).
Who is affected
Per Fortinet advisory FG-IR-24-423 and NVD: FortiManager 7.6.0 (fixed in 7.6.1), 7.4.0 to 7.4.4 (fixed in 7.4.5), 7.2.0 to 7.2.7 (fixed in 7.2.8), 7.0.0 to 7.0.12 (fixed in 7.0.13), 6.4.0 to 6.4.14 (fixed in 6.4.15) and 6.2.0 to 6.2.12 (fixed in 6.2.13). FortiManager Cloud 7.4.1 to 7.4.4 (fixed in 7.4.5), 7.2.1 to 7.2.7 (fixed in 7.2.8) and 7.0.1 to 7.0.12 (fixed in 7.0.13). FortiManager Cloud 6.4: all versions, migrate to a fixed release. FortiManager Cloud 7.6 is not affected. The advisory also lists older FortiAnalyzer models when the FortiManager feature is on and an interface has the fgfm service enabled.
Timeline
-
23 Oct 2024
Fortinet publishes advisory FG-IR-24-423 with fixes, marked known exploited. NVD publishes the record and CISA adds the CVE to its Known Exploited Vulnerabilities catalog.
-
Oct to Nov 2024
Fortinet updates the advisory several times between 24 October and 27 November 2024 with workarounds, recommendations for managed devices and more indicators of compromise.
-
13 Nov 2024
CISA due date for federal agencies to apply the vendor mitigations.
-
14 Oct 2026
Palo Alto Networks Unit 42 publishes a report that names this flaw as the first access route in an intrusion it tracks as CL-STA-0954, in which the malware PEERSTITCH was found.
Who exploits it
What to do
-
Upgrade FortiManager
Move to a fixed release: 7.6.1, 7.4.5, 7.2.8, 7.0.13, 6.4.15 or 6.2.13 or later. FortiManager Cloud 6.4 has no fix and must be migrated.
-
Block unknown devices
Fortinet's first workaround is to enable fgfm-deny-unknown on FortiManager 7.0.12, 7.2.5 and 7.4.3 or later. A FortiGate missing from the device list will then be refused, so check the list first.
-
Limit who can reach port 541
On 7.2.0 and later, use local-in policies so only the FortiGate addresses you expect can connect to the FortiManager service on port 541. A custom certificate setting is another option on newer versions.
-
Treat stored secrets as exposed
Fortinet advises changing credentials on FortiManager and on every managed device. Unit 42 adds that credentials and certificates held on a compromised management platform stay valid until they are rotated.
-
Hunt for the listed signs
The advisory lists log entries for unregistered device additions and serial number edits, plus files named .tm in /tmp and /var/tmp. The advisory warns that file traces may not appear in every case.
Questions
What does CVE-2024-47575 allow?
A remote attacker without a login can run code or commands on a vulnerable FortiManager by sending crafted requests. Fortinet and NVD both score it 9.8 out of 10.
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 23 October 2024 and Fortinet's advisory says reports show exploitation in the wild. CISA lists ransomware campaign use as unknown.
Is this flaw linked to PEERSTITCH?
Palo Alto Networks Unit 42 says so in its report of 14 October 2026. In the intrusion it describes, attackers used this flaw for first access to FortiManager. A second flaw, CVE-2025-61624 in FortiOS, was used to get root before the malware was installed. CISA and Fortinet do not name the malware.
What should I do if I cannot patch today?
Use the workarounds in Fortinet advisory FG-IR-24-423: refuse unknown devices and restrict port 541 to known FortiGate addresses. Upgrade as soon as you can, and rotate credentials if you suspect exposure.
Sources
- FG-IR-24-423 Missing authentication in fgfmsd Fortinet PSIRT
- Known Exploited Vulnerabilities catalog (data file) CISA
- CVE-2024-47575 record NIST NVD
- PEERSTITCH report on CVE-2024-47575 intrusion (attributed by Palo Alto Networks Unit 42) Palo Alto Networks Unit 42
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 51 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 25 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 54 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 37 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 50 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 105 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.