Critical Out-of-Bounds Write (CVE‑2024‑21762) in Fortinet FortiOS Allows Remote Code Execution
What It Is — Fortinet FortiOS contains an out‑of‑bounds write flaw that can be triggered by a specially‑crafted HTTP request. The vulnerability is unauthenticated and remote, enabling an attacker to execute arbitrary code or commands on the affected appliance.
Exploitability — No public exploit has been observed, but the CVSS base score is 9.8 (Critical), indicating a high likelihood of exploitation once a weaponized request is available.
Affected Products — Fortinet FortiOS (all versions prior to the vendor‑released patch).
Why It Matters for Trust & Control Assurance
- Continuous vulnerability‑management controls must capture this flaw, generate timely remediation evidence, and feed it into audit‑ready dashboards.
- Demonstrable patch‑management and configuration‑hardening signals to customers that the organization maintains a defensible security posture.
- Evidence of rapid response to high‑severity CVEs satisfies the “Vulnerability Management” control objective that underpins multiple frameworks (e.g., NIST CSF Identify, ISO 27001 A.12.6).
Recommended Actions
- Apply Fortinet’s emergency patch for CVE‑2024‑21762 immediately.
- Verify the running FortiOS version across all appliances and update inventory records.
- Run an authenticated scan to confirm remediation and capture scan logs as evidence.
- Document the incident response steps in your change‑management system for audit purposes.
Source: CISA KEV – CVE‑2024‑21762