Vulnerability Snapshot
CVE-2024-23113 is rated HIGH — exploitation is straightforward for a motivated attacker and impact is significant. Apply the vendor patch within your standard high-severity SLA.
This vulnerability appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, meaning it has been observed in active attacks. Federal agencies have a remediation deadline; commercial defenders should treat it with equivalent urgency.
Affected technology: FortiOS 7.0.x, FortiOS 7.2.x, FortiOS 7.4.x, FortiProxy, FortiPAM.
Vulnerability Overview
CVE-2024-23113 is a format string vulnerability (CWE-134) in the Fortinet FortiOS fgfmd daemon. The daemon handles communication between FortiGate devices and FortiManager.
A remote unauthenticated attacker can exploit this flaw by sending specially crafted requests to the fgfmd service, potentially achieving arbitrary code execution with root privileges on the FortiGate device.
Impact Assessment
• CVSS Score: 9.8 / 10 (Critical)
• Attack Vector: Network (remote, unauthenticated)
• Privileges Required: None
• Impact: Complete system compromise
• CISA KEV: Yes — actively exploited
Affected Products
• FortiOS 7.4.0 through 7.4.2
• FortiOS 7.2.0 through 7.2.6
• FortiOS 7.0.0 through 7.0.13
• FortiProxy 7.4.0 through 7.4.2
• FortiPAM 1.2, 1.1, 1.0
Recommended Actions
How Vulnios Detects This
Vulnios scans for this vulnerability using KEV cross-check that flags any host where this CVE is already on CISA's exploited list. Run a scan against your environment to see whether you are exposed; findings are linked back to the original CVE record so triage starts with the patch path already known.
AI Security Advisor
Powered by Gemini
Get AI-powered security recommendations tailored to this specific threat — including risk assessment, detection guidance, MITRE ATT&CK mapping, and actionable remediation steps.
Affected Products
Sources
Related Threat Alerts
- SANS Internet Storm Center Advisory — Oct 26, 2026
- SANS Internet Storm Center Advisory — Oct 23, 2026
- Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action
- Uncontrolled Resource Consumption in SNMP
- Improper Authentication of FortiPAM Server
- VU#936962: Multiple file parsing vulnerabilities in FastStone Image Viewer 8.3.0.0
Frequently Asked Questions
What is CVE-2024-23113?
CVE-2024-23113 is a high-severity vulnerability tracked under the Common Vulnerabilities and Exposures program. Fortinet FortiOS fgfmd daemon contains a format string vulnerability allowing remote unauthenticated attackers to execute arbitrary code via specially crafted requests.
Am I affected?
Check whether your environment runs FortiOS 7.0.x, FortiOS 7.2.x, FortiOS 7.4.x, FortiProxy, FortiPAM. If you operate any of those, treat yourself as in scope until you have evidence otherwise. A Vulnios scan will identify the exact assets carrying the affected version.
How urgent is the response?
High: address inside your standard high-severity SLA (typically 7 days for internet-exposed assets, 30 days for internal). Skip ahead in the queue if the host is internet-facing.
How do I remediate?
Apply the vendor patch listed in the upstream advisory linked under Sources. If the patch is not yet available, follow the vendor-supplied workaround (often a config flag or feature disable) and add detections for the published exploit pattern in your SIEM. Re-scan after the patch lands to confirm the finding clears.
Where can I track exploitation activity?
Watch CISA's Known Exploited Vulnerabilities catalog for CVE-2024-23113. Cross-reference with public exploit databases and your own SIEM/IDS for indicator-of-compromise patterns. Vulnios tracks KEV status automatically and surfaces it on the asset findings view.
How does Vulnios help with this?
Vulnios continuously cross-references your asset inventory against the live CVE feed (NVD, vendor advisories, CISA KEV, and curated OSINT). When a new CVE matches your environment, you get a prioritized finding with the severity, KEV status, exploit-prediction (EPSS), and a direct path to the vendor patch. You can start a free scan from the homepage.
Protect Your Organization
Monitor CVEs, scan for vulnerabilities, and get real-time threat alerts — all in one platform.
Weekly threat digest
KEV-listed exploits and vendor advisories, every Monday.
One email a week. Unsubscribe any time.
Get instant alerts on Telegram
Join our public channel for real-time critical CVE alerts.
Follow @vulnios