CVE-2024-47575
Fortimanager100/100
confirmed exploited
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.
Listed in CISA KEV and VulnCheck KEV (confirmed exploited in the wild) · EPSS 0.948 (probability of exploitation) · CVSS base 9.8 · 8 public PoC/exploit reference(s) available
Public PoC / Exploit8
Defensive review only — these references demonstrate exploitability.
githubwatchtowrlabs/Fortijump-Exploit-CVE-2024-47575 (★97)githubrevanslbw/CVE-2024-47575-POC (★0)githubAnnnNix/CVE-2024-47575 (★0)vulncheck-xdbVulnCheck XDB 8df10500 (initial-access)vulncheck-xdbVulnCheck XDB bf46bb5d (initial-access)vulncheck-xdbVulnCheck XDB 8204500c (initial-access)vulncheck-xdbVulnCheck XDB 4d8956df (initial-access)vulncheck-xdbVulnCheck XDB 95495765 (initial-access)
References2
Mentions 1