CVE-2024-23113
Fortinet Multiple Products
Fortinet Multiple Products Format String Vulnerability
What it is
Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor notices and references
Description and required action as published by CISA. Full record at NVD.
Other Fortinet entries on the list
- Multiple Products Fortinet Multiple Products Path Traversal Vulnerability CVE-2025-61624 · Oct 16, 2026
- FortiMail Fortinet FortiMail Path Traversal Vulnerability CVE-2026-104286 · Oct 1, 2026
- Multiple Products Fortinet Multiple Products Heap-based Buffer Overflow Vulnerability CVE-2025-25249 · Sep 9, 2026
- FortiOS Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability CVE-2025-68686 · Jul 27, 2026
- FortiSandbox Fortinet FortiSandbox OS Command Injection Vulnerability CVE-2026-39808 · Jul 16, 2026
- FortiSandbox Fortinet FortiSandbox OS Command Injection Vulnerability CVE-2026-25089 · Jul 16, 2026