
CVE-2024-21762: Fortinet FortiOS SSL VPN RCE, CVSS 9.6
CVE-2024-21762 is a CVSS 9.6 out-of-bounds write in Fortinet FortiOS and FortiProxy SSL VPN. An unauthenticated remote attacker sends specially crafted HTTP requests to the SSL VPN web management interface, achieving arbitrary code or command execution. CISA added it to the Known Exploited Vulnerabilities catalog on February 9, 2024, one day after disclosure, confirming active exploitation. Over 150,000 Fortinet devices were estimated to be running vulnerable firmware at time of disclosure.
