CVE-2024-40593

MediumCVSS 6.0

Published: 11/12/2025(UTC)Updated: 02/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

Summary

A key management errors vulnerability in Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiPortal may allow an authenticated admin to retrieve a certificate's private key via the device's admin shell.

Risk Assessment

The risk includes potential disclosure of private keys, leading to compromise of communication confidentiality and system trust.

Recommendation

Apply available security updates and restrict access to the admin shell to trusted administrators only.

Other vulnerabilities in Fortinet FortiAnalyzer

CVE-2025-53845Medium
An improper authentication vulnerability (CWE-287) in Fortinet FortiAnalyzer versions 7.6.0 through 7.6.3 and before 7.4.6 allows an unauthenticated attacker to obtain device health and status information or cause a denial of service via crafted OFTP requests.

Original NVD description (English source)

A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiManager 7.4.0 through 7.4.2, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0 all versions, FortiManager 6.4 all versions, FortiOS 7.6.0, FortiOS 7.4.4, FortiOS 7.2.7, FortiOS 7.0.14, FortiPortal 6.0 all versions may allow an authenticated admin to retrieve a certificate's private key via the device's admin shell.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS