CVE-2024-26009

CWE-2884 documents4 sources
Severity
8.1HIGH
EPSS
0.1%
top 69.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Fortinet FortiosFortinet FortiproxyFortinet Fortiswitchmanager+1 more
Timeline
PublishedAug 12

Description

An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS version 6.4.0 through 6.4.15 and before 6.2.16, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8 and before 7.0.15 & FortiPAM before version 1.2.0 allows an unauthenticated attacker to seize control of a managed device via crafted FGFM requests, if the device is managed by a FortiManager, and if the attacker knows that FortiManager's serial number.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages8 packages

▶NVDfortinet/fortios6.0.0 — 6.2.17+1
▶NVDfortinet/fortiproxy7.0.0 — 7.0.16+2
▶CVEListV5fortinet/fortios6.4.0 — 6.4.15+2
▶CVEListV5fortinet/fortipam1.1.0 — 1.1.2+2
▶NVDfortinet/fortipam1.0.0 — 1.2.0

🔴Vulnerability Details

2
CVEList
CVE-2024-26009: An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS version 6↗2025-08-12
▶
GHSA
GHSA-g3r6-2cv3-63vw: An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS version 6↗2025-08-12
▶

📋Vendor Advisories

1
Fortinet
Weak authentication - FGFM protocol↗2025-08-12
▶
CVE-2024-26009 (HIGH CVSS 8.1) | An authentication bypass using an a | cvebase.io