FortiOS out-of-bounds write (CVE-2024-21762) — code or commands executable without authentication, with the deadline cut to seven days
An out-of-bounds write vulnerability in Fortinet FortiOS. Unauthenticated remote parties are described as able to execute code or commands through crafted HTTP requests. The remediation deadline was set seven days after listing.
Key facts
- CVE IDCVE-2024-21762
- Affected (vendor / product)Fortinet FortiOS
- CWECWE-787
- ExploitationListed in CISA KEV (exploitation confirmed); also confirmed used in ransomware
- Remediation due2024-02-16 (U.S. federal civilian agencies, BOD 22-01)
Key points
- The affected product is Fortinet FortiOS, classified as CWE-787, out-of-bounds write.
- A remote unauthenticated party is described as able to execute code or commands via crafted HTTP requests.
- Writing beyond a reserved region replaces adjacent regions, so a program can behave otherwise than intended.
- Across the records this site holds as of 2026-09-03, classes arising from memory handling form a large share of exploited vulnerabilities.
- Added February 9, 2024 with a due date of February 16, seven days later, shorter than the standard 21.
1The shape of an out-of-bounds write
A program reserves a region of a certain size in advance to hold data. Writing more than that region can hold overwrites the adjacent region as well. That is the class of flaw called an out-of-bounds write.
Adjacent regions may hold other data, or information governing how the program behaves. Replaced, the program can behave otherwise than intended. That is what the catalog points to in saying code or commands may be executed.
2A class arising from memory handling
- 1ReservingA region of the size estimated as needed is reserved
- 2WritingData received is placed into the region
- 3CheckingWhether what is placed fits within the region is verified
- 4Where the flaw arisesWhere that check is insufficient
Of the 1,694 entries this site holds as of 2026-09-03, 98 unpublished ones are classified as out-of-bounds write. Neighbouring classes account for 84 and 90 respectively. Classes arising from how memory is handled make up a large share of the vulnerabilities that are actually exploited.
3That authentication is not required
This one is described as available to a remote unauthenticated party — someone holding no credentials, merely positioned to send requests to the device. This site covers other classes reachable without authentication, and flaws holding before the authentication stage recur throughout.
4Seven days
The deadline of seven days sits well short of the standard 21. Being a device at a boundary, requiring no authentication, and being exploited in practice evidently combined. The length of a deadline is one of the few signals of priority the catalog publishes.
Why it matters
A vulnerability requiring no authentication holds for anyone merely positioned to send requests. The more a device sits at a boundary, the more parties occupy that position.
FAQ
What is an out-of-bounds write?
Why a seven-day deadline?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).