FFortinet has updated their security advisory addressing a critical FortiManager vulnerability (CVE-2024-47575) to include additional workarounds and indicators of compromise (IOCs). A remote, unauthenticated cyber threat actor could exploit this vulnerability to gain access to sensitive files or take control of an affected system. At this time, all patches have been released.

The Cybersecurity and Infrastructure Security Agency (CISA) previously added this vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation, as confirmed by Fortinet.

CISA strongly encourages users and administrators to apply the necessary updates, hunt for any malicious activity, assess potential risk from service providers, report positive findings, and review the following information:

• Fortinet Advisory FG-IR-24-423
• CISA alert on the Fortinet FortiManager Missing Authentication Vulnerability
• Google Threat Intelligence blog post Investigating FortiManager Zero-Day Exploitation (CVE-2024-47575).