CVE Watch—

CVE-2024-23113

Fortinet Multiple Products Format String Vulnerability

CVSS

—

No CVSS

EPSS

61.7%

p99

KEV

YES

Oct 9, 2024

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

61.7%EPSS · 30 days61.7%

2026-09-172026-10-15

KEV catalog record

Product

Fortinet / Multiple Products

Vulnerability

Fortinet Multiple Products Format String Vulnerability

Added to KEV

Oct 9, 2024

Remediate by

Oct 30, 2024

Known ransomware use

Summary description

Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://www.fortiguard.com/psirt/FG-IR-24-029 ; https://nvd.nist.gov/vuln/detail/CVE-2024-23113

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-252498.1 HIG

89.9%

KEV—77Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability8d CVE-2022-406849.8 CRI

100.0%

KEV—80Fortinet Multiple Products Authentication Bypass Vulnerability71d CVE-2026-24858—

99.7%

KEV—80Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability—CVE-2025-59718—

99.3%

KEV—80Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability—CVE-2025-32756—

98.2%

KEV—79Fortinet Multiple Products Stack-Based Buffer Overflow Vulnerability—