CVE-2024-47575: FortiManager Authentication Bypass

Source-specific exposure conditions

• FortiManager versions 6.2.0–6.2.12, 6.4.0–6.4.14, 7.0.0–7.0.12, 7.2.0–7.2.7, 7.4.0–7.4.4, or 7.6.0.
• FortiManager Cloud versions 6.4.1–6.4.7, 7.0.1–7.0.12, 7.2.1–7.2.7, or 7.4.1–7.4.4.
• A remotely reachable FortiManager service accepting specially crafted requests. Fortinet describes the vulnerability as unauthenticated.
• Certain FortiAnalyzer models are also affected when FortiManager-on-FortiAnalyzer is enabled and at least one interface has the FortiGate management service enabled.

Source-specific remediation

• Upgrade FortiManager 6.2 deployments to 6.2.13 or later; 6.4 to 6.4.15 or later; 7.0 to 7.0.13 or later; 7.2 to 7.2.8 or later; 7.4 to 7.4.5 or later; and 7.6 to 7.6.1 or later.
• Upgrade affected FortiManager Cloud deployments to the corresponding fixed release: 6.4.8 or later where available through Fortinet’s supported migration path, 7.0.13 or later, 7.2.8 or later, or 7.4.5 or later. Fortinet states that all FortiManager Cloud 6.4 versions require migration to a fixed release.
• If immediate upgrade is not possible, apply Fortinet’s documented compensating controls appropriate to the installed branch, including restricting unknown-device registration, limiting management connections to approved FortiGate addresses, or using the supported custom-certificate control.
• Treat affected systems as potentially compromised because Fortinet reports active exploitation. Review the FortiManager and managed-device environment for unauthorized changes, credential exposure, and suspicious registration activity, and follow Fortinet’s recovery guidance if compromise is suspected.

Source-specific verification

• Confirm the installed FortiManager or FortiManager Cloud release is at or above the applicable Fortinet fixed version for its branch.
• Confirm any compensating control is enabled through an approved configuration review and that management connectivity remains limited to intended devices or sources.
• Review Fortinet’s listed log indicators, serial numbers, IP indicators, and file indicators. The listed log entries can also represent failed exploitation attempts on patched systems, so they are not by themselves proof of compromise.
• For FortiAnalyzer deployments, confirm whether the affected FortiManager-on-FortiAnalyzer feature and FortiGate management service exposure are enabled.

Uncertainty and evidence gaps

• The supplied product list includes FortiManager Cloud 6.4.1–6.4.7, while Fortinet’s advisory describes FortiManager Cloud 6.4 as requiring migration to a fixed release rather than naming a specific fixed 6.4 version.
• The advisory does not establish that every deployment exposes the vulnerable service externally; exposure depends on reachability and service configuration.
• A version check alone cannot determine whether a system was previously compromised.

Claim-to-source evidence

• Affected Product: CVE-2024-47575 affects FortiManager and FortiManager Cloud, with additional impact to certain FortiAnalyzer models when FortiManager-on-FortiAnalyzer and the relevant management service are enabled. Evidence
• Affected Version: Fortinet identifies affected FortiManager branches as 6.2.0–6.2.12, 6.4.0–6.4.14, 7.0.0–7.0.12, 7.2.0–7.2.7, 7.4.0–7.4.4, and 7.6.0, with corresponding affected FortiManager Cloud branches. Evidence
• Exposure: The vulnerability is a missing-authentication issue in the FortiManager daemon that may allow a remote unauthenticated attacker to execute arbitrary code or commands through specially crafted requests. Evidence
• Fixed Version: Fortinet lists fixed releases beginning at FortiManager 6.2.13, 6.4.15, 7.0.13, 7.2.8, 7.4.5, and 7.6.1, with corresponding Cloud fixes for the applicable branches. Evidence
• Remediation: Fortinet recommends upgrading to a fixed release and documents compensating controls involving unknown-device registration, source restriction, and custom certificate validation where supported. Evidence
• Verification: Fortinet provides log, IP, serial-number, and file indicators and cautions that some log entries may indicate failed attempts even on patched systems. Evidence

Synthesis sources

• fortiguard.fortinet.com

Generation provenance

Model

gpt-5.6-luna

Generated

2026-07-18T10:48:36Z

Prompt version

2026-07-14.2

Specificity

specific

Source fingerprint

c533b7c872c4538f03da32af6a8b510d424a35dba96524bbbdc1f72b16a27d46

Recorded gaps

• generic_ecosystem