Description
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortinet | FortiManager | 7.6.0, 7.4.0 – ≤ 7.4.4, 7.2.0 – ≤ 7.2.7, 7.0.0 – ≤ 7.0.12, 6.4.0 – ≤ 6.4.14, 6.2.0 – ≤ 6.2.12 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Fortinet FortiManager Unauthenticated RCE
exploit/linux/misc/fortimanager_rce_cve_2024_47575
GitHub 3 repositories
-
watchtowrlabs/Fortijump-Exploit-CVE-2024-47575 ★ 97 · Nov 7, 2024
Fortinet Fortimanager Unauthenticated Remote Code Execution AKA FortiJump CVE-2024-47575
-
AnnnNix/CVE-2024-47575 ★ 0 · Jul 19, 2025
PoC for CVE-2024-47575
-
revanslbw/CVE-2024-47575-POC ★ 0 · Jan 5, 2025
CVE POC Exploit
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- NCSC-2024-0423 Kwetsbaarheid ontdekt in Fortinet FortiManager NCSC-NL (Netherlands) · Nov 15, 2024
- WID-SEC-2024-3260 Fortinet FortiManager: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Oct 23, 2024