Fortinet patches CVE-2024-21762, a critical remote code execution vulnerability that may have been exploited in the wild.
February 9, 2024 By Eduard Kovacs
Fortinet on Thursday announced patches for a critical remote code execution vulnerability in FortiOS that may have been exploited in the wild.
The security hole, tracked as CVE-2024-21762, impacts FortiOS versions 6.0, 6.2, 6.4, 7.0, 7.2 and 7.4. Patches have been released for each impacted version, except for 6.0 — 6.0 users are being advised to migrate to a newer version. FortiOS 7.6 is not affected by the vulnerability.
As a workaround, users can disable the SSL VPN feature. Disabling the SSL VPN web mode does not mitigate the vulnerability, Fortinet said.
CVE-2024-21762 appears to be a zero-day, with Fortinet saying that it’s “potentially being exploited in the wild”.
