DaystoPatch

FortinetExploited incident

FortiManager fgfmd missing authentication allowing unauthenticated RCE ("FortiJump")

CVE-2024-47575Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 23 Oct 2024

  • Exploited before a fix
FixedFixed for every supported version 10 days after the first public report.
Embed this live clock

Response

Silence
10d
First public report to first vendor statement
Exposure
4d
First public report to first fixUnverified source
Follow-through
10d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    Kevin Beaumont on Mastodon (cyberplace.social)CuratedQuote verified

    Hello everybody. If you use FortiManager from FortiNet you should be prepared to grab the latest available release from the support portal and upgrade.

    Post time from the status's created_at (2024-10-13T10:59:38.077Z). The same post says 'Patches aren’t out yet. Mitigation is available. If you have FortiManager facing the internet, I’d say remove it from the internet now.' It warns of an unpatched FortiManager risk but does not yet say 'exploited'.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:d4d51c1a667e10f3…
    Used in metrics
    Yes
    Dispute this timestamp
    8 more sources for this moment
    Kevin Beaumont on Mastodon (cyberplace.social)CuratedQuote verified19 Oct 2024, 00:21 UTC

    FortiGate have released one of the six new versions of FortiManager which fix the actively exploited zero day in the product

    First public post found that explicitly says the FortiManager zero day was actively exploited (created_at 2024-10-19T00:21:35.612Z).

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:fcd13a5172234b49…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Kevin Beaumont, DoublePulsar (Wayback snapshot 2024-10-22 21:17 UTC)CuratedQuote verified22 Oct 2024

    Did you know there’s widespread exploitation of FortiNet products going on using a zero day, and that there’s no CVE?

    Beaumont's blog post, captured by Wayback at 2024-10-22 21:17Z showing 'Just now' (his Mastodon post linking it is 2024-10-22T20:49Z). Earlier Mastodon posts from 2024-10-13 and 2024-10-19 are recorded as earlier world candidates. Quote verified against archived copy https://web.archive.org/web/20241022211710/https://doublepulsar.com/burning-zero-days-fortijump-fortimanager-vulnerability-used-by-nation-state-in-espionage-via-msps-c79abec59773

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:adf3dc6edfa8fc0a…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Fortinet advisory FG-IR-24-423ClaimedQuote verified23 Oct 2024

    Missing authentication in fgfmsd

    The vendor's own disclosure.

    Source
    Fortinet advisory FG-IR-24-423 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:55376a41f94c5287…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-47575)ClaimedQuote verified23 Oct 2024

    Fortinet FortiManager Missing Authentication Vulnerability

    Added to CISA's KEV catalog on 2024-10-23.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2024-47575ClaimedQuote verified23 Oct 2024, 15:03 UTC

    A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:59b5e91bb05f58cc…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet23 Oct 2024, 15:15 UTC

    ID: CVE-2024-47575

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet23 Oct 2024, 20:14 UTC

    Most of the time # BusinessTinder # LinkedIn is stupid. But this is my kind of stupid. # F0rtiDay # CVE_2024_47575

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet24 Oct 2024, 15:43 UTC

    Investigating FortiManager Zero-Day Exploitation (CVE-2024-47575)

    Earliest third-party post we hold. An independent author on another platform posted within 48 hours. Used for unreviewed incidents only, never graded.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    +10d

    CVE record CVE-2024-47575 (CNA: Fortinet)CuratedQuote verified

    "datePublished":"2024-10-23T15:03:48.798Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:59b5e91bb05f58cc…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    Fortinet PSIRT FG-IR-24-423CuratedQuote not checked yet23 Oct 2024

    2024-10-23: Initial publication

    Source
    Fortinet PSIRT FG-IR-24-423 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    date only+10d

    Fortinet PSIRT FG-IR-24-423 (Wayback snapshot 2024-10-24 02:04 UTC)CuratedQuote verified

    prevent unknown devices to attempt to register:

    fgfm-deny-unknown workaround in the first capture, whose timeline shows only the two 2024-10-23 entries. More workarounds were added 2024-10-24. Fortinet had shared mitigation steps privately with customers from 2024-10-13 (BleepingComputer), which does not count as public.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5e6e0165a8679ad7…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Fortinet advisory FG-IR-24-423ClaimedQuote verified24 Oct 2024

    2024-10-24: Added workarounds to block the addition of unauthorized devices via syslog or FDS

    From the advisory's revision history.

    Source
    Fortinet advisory FG-IR-24-423 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:46aa0a6df5ee536e…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Fortinet advisory FG-IR-24-423ClaimedQuote verified28 Oct 2024

    2024-10-28: Added note in workaround 1. (FMG Cloud recommended workaround)

    From the advisory's revision history.

    Source
    Fortinet advisory FG-IR-24-423 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:46aa0a6df5ee536e…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  4. First fix

    date only+4dUnverified: no archived copy, quote not checked yet

    Fortinet docs: FortiManager 7.4.5 release notes change logCuratedQuote not checked yet

    2024-10-17 Initial release.

    R2: FortiManager 7.4.5 (a fixed version in FG-IR-24-423) was released 2024-10-17, six days before the advisory. Per the audit, other branches followed: 7.2.8 '2024-10-18 Initial release', 7.0.13 2024-10-22, 6.2.13 2024-10-23, 7.6.1 and 6.4.15 2024-10-24 (not re-fetched here). source_kind 'vendor_advisory' is the closest kind for vendor release notes.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Kevin Beaumont on Mastodon (cyberplace.social)CuratedQuote verified19 Oct 2024, 00:21 UTC

    FortiGate have released one of the six new versions of FortiManager which fix the actively exploited zero day in the product

    Later corroboration: a fixed FortiManager build was already downloadable when this was posted; the 7.4.5 release notes date it to 2024-10-17 (created_at 2024-10-19T00:21:35.612Z); which build and its exact release time were not established. Beaumont later posted 'FortiNet just released FortiManager 7.0.13, which fixes the FortiManager zero day for 7.0.' (2024-10-22T22:45:37Z, status 113353499434368371) and 'Somebody posted the list of impacted FortiManager versions and fixed versions on Reddit. 3 of the versions don’t have patches available.' (2024-10-22T17:02Z), so fixes were staggered between 2024-10-18/19 and the 2024-10-23 advisory.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:fcd13a5172234b49…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Fortinet PSIRT FG-IR-24-423 (Wayback snapshot 2024-10-24 02:04 UTC)CuratedQuote verified23 Oct 2024

    Upgrade to 7.6.1 or above

    Fixed releases listed for every branch in the first advisory capture (none 'upcoming'). Upper bound: several fixed builds shipped before the advisory, from about 2024-10-18/19 (see the Mastodon-sourced patch_first candidate).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5e6e0165a8679ad7…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date only+10d

    Fortinet PSIRT FG-IR-24-423 (Wayback snapshot 2024-10-24 02:04 UTC)CuratedQuote verified

    Upgrade to 6.2.13 or above

    FortiManager 7.6/7.4/7.2/7.0/6.4/6.2 and FortiManager Cloud 7.4/7.2/7.0 fixed in the first capture ('2024-10-23: Add FortiManager Cloud fixes'); FortiManager Cloud 6.4 is 'Migrate to a fixed release' and not counted.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5e6e0165a8679ad7…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

FortiManager zero-day 'FortiJump' stole firewall configs; fixes from Oct 17

Attackers exploited a FortiManager flaw that lets anyone reach its device-management service and run code; fixed builds appeared from 17 October 2024 and Fortinet's advisory followed on 23 October.

In plain words

Fortinet's FortiManager, the server that centrally manages Fortinet firewalls, had a critical flaw that attackers used to take it over and copy the settings and passwords of the firewalls it controls. Fixed versions began shipping on 17 October 2024 and Fortinet's public advisory came on 23 October. If we run FortiManager, it must be on a fixed version and, if there is any sign it was accessed, the credentials of every managed firewall should be changed.

What happened and who is affected

What happened

Attackers used CVE-2024-47575, a missing authentication bug in FortiManager's fgfmd daemon, to run code on FortiManager servers and copy the configurations, IP addresses and credentials of the firewalls they manage. Researcher Kevin Beaumont warned publicly on 13 October 2024 that FortiManager users should prepare to upgrade, and on 19 October that fixed builds were appearing (FortiManager 7.4.5 had been released on 17 October); Fortinet sent private notices to customers from 13 October. Fortinet published advisory FG-IR-24-423 with fixed versions for all branches and workarounds on 23 October 2024.

Who is affected

FortiManager 7.6.0, 7.4.0-7.4.4, 7.2.0-7.2.7, 7.0.0-7.0.12, 6.4.0-6.4.14 and 6.2.0-6.2.12; FortiManager Cloud 7.4.1-7.4.4, 7.2.1-7.2.7, 7.0.1-7.0.12 and all 6.4; and some older FortiAnalyzer models with the FortiManager feature enabled.

CVE-2024-47575. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/fortinet-cve-2024-47575/

Affected products

  • FortiManager
  • FortiManager Cloud
  • FortiAnalyzer (with FortiManager feature enabled)
How we built this timeline

Zero-day: exploited before any fix (Beaumont, 23 Oct 2024: 'exploitation stems to at least September'). Public signals before the advisory came from Kevin Beaumont's Mastodon posts (13 Oct 2024 at-risk warning; 19 Oct 2024 'actively exploited zero day' and first fixed build), fetched via the cyberplace.social API.

Fortinet notified customers privately from 13 Oct 2024 (BleepingComputer: 'The company privately warned FortiManager customers about the flaw starting October 13th in advanced notification emails'); that is not a public acknowledgement. Advisory timeline lists many later IoC/workaround additions (24 Oct 2024 to 27 Nov 2024).

Fortinet CVSSv3 9.8. KEV 23 Oct 2024.

Unit 42 later tied the FortiManager entry point to the PEERSTITCH activity (see fortinet-cve-2025-61624).

Related

Fortinet report card