Actively exploited in the wild
Fortinet FortiManager Missing Authentication Vulnerability
Fortinet - FortiManager · Listed in the CISA KEV since 2024-10-23. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-47575
CriticalCVSS 9.8KEVSummary
A missing authentication for critical function in FortiManager and FortiManager Cloud allows an attacker to execute arbitrary code or commands via specially crafted requests.
Risk Assessment
An unauthenticated attacker can take control of FortiManager, potentially compromising the entire managed infrastructure.
Recommendation
Immediately update FortiManager and FortiManager Cloud to patched versions as indicated by the vendor.
Other vulnerabilities in FortiManager
See all- CVE-2026-22575Medium
An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPS requests.
- CVE-2026-70468High
An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiManager 7.6.1, 7.4.3 through 7.4.5, 7.2.5 through 7.2.9, FortiManager Cloud 7.6.1, 7.4.3 through 7.4.5, 7.2.5 through 7.2.9 may allow attacker to improper access control.
- CVE-2024-33503Medium
A privilege management vulnerability in Fortinet FortiManager and FortiManager Cloud allows unauthorized privilege escalation via specific shell commands. Affected versions include 7.4.0-7.4.3, 7.2.0-7.2.5, 7.0, and 6.4.
Original NVD description (English source)
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager 6.2.0 through 6.2.12, Fortinet FortiManager Cloud 7.4.1 through 7.4.4, FortiManager Cloud 7.2.1 through 7.2.7, FortiManager Cloud 7.0.1 through 7.0.12, FortiManager Cloud 6.4.1 through 6.4.7 allows attacker to execute arbitrary code or commands via specially crafted requests.