Skip to content
skopnix

Actively exploited · CISA KEV · NVD published 2024-02-09

CVE-2024-21762

A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2.0 through 6.2.15, 6.0.0 through 6.0.17, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, 2.0.0 through 2.0.13, 1.2.0 through 1.2.13, 1.1.0 through 1.1.6, 1.0.0 through 1.0.7 allows attacker to execute unauthorized code or commands via specifically crafted requests

  1. KEV
  2. 20 days →First PoC

Signals

Exploited in the wild
Yesadded 2024-02-09 · due 2024-02-16 · known ransomware use. An observation, not a forecast.
EPSS · 30-day forecast
83%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · CRITICAL
9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

33 known · links only

GitHub PoCs · by trust, then stars33

  1. h4x0r-dz/CVE-2024-21762 ↗Trust ok 100

    out-of-bounds write in Fortinet FortiOS CVE-2024-21762 vulnerability

    ★ 150 · created 2024-03-13

  2. BishopFox/cve-2024-21762-check ↗Trust ok 100

    Safely detect whether a FortiGate SSL VPN is vulnerable to CVE-2024-21762

    ★ 107 · created 2024-02-28

  3. r4p3c4/CVE-2024-21762-Exploit-PoC-Fortinet-SSL-VPN-Check ↗Trust ok 100

    Chequea si tu firewall es vulnerable a CVE-2024-21762 (RCE sin autenticación)

    ★ 16 · created 2024-03-13

  4. d0rb/CVE-2024-21762 ↗Trust ok 100

    The PoC demonstrates the potential for remote code execution by exploiting the identified security flaw.

    ★ 12 · created 2024-03-17

  5. abrewer251/CVE-2024-21762_FortiNet_PoC ↗Trust ok 100

    Proof-of-concept scanner targeting CVE-2024-21762 in FortiOS SSL VPN’s /remote/hostcheck_validate endpoint with reverse shell payload delivery.

    ★ 4 · created 2025-05-22

  6. Vampsecure-Labs/vamp-forticheck ↗Trust ok 100

    VampSecure Labs: FortiOS CVE scanner (CVE-2018-13379, CVE-2022-40684, CVE-2023-27997, CVE-2024-21762)

    ★ 2 · created 2026-07-31

  7. abraxas/Fortigate-SSL-VPN-Exploit-Kit ↗Trust ok 100

    The FortiGate SSL-VPN pot of gold. CVE-2024-21762 and CVE-2023-27997. 79 working exploit clients. 53 hardware SKUs. 55 FortiOS builds.

    ★ 1 · created 2026-09-01

  8. rdoix/cve-2024-21762-checker ↗Trust ok 100

    ★ 1 · created 2024-06-20

  9. 0x0asif/CVE-2024-21762 ↗Trust ok 100

    ★ 0 · created 2026-03-12

  10. 0x13-ByteZer0/CVE-2024-21762 ↗Trust ok 100

    ★ 0 · created 2026-01-13

  11. CrackerCat/cve-2024-21762-poc ↗Trust ok 100

    CVE-2024-21762 是 Fortinet 公司的 FortiOS 和 FortiProxy 产品中的一个严重漏洞，存在于其 SSL VPN 组件中。

    ★ 0 · created 2025-04-03

  12. deFr0ggy/CVE-2024-21762-Checker ↗Trust ok 100

    This script performs vulnerability scanning for CVE-2024-21762, a Fortinet SSL VPN remote code execution vulnerability. It checks whether a given server is vulnerable to this CVE by sending specific requests and analyzing the responses.

    ★ 0 · created 2024-10-24

  13. Sxmpl3/CVE-2024-21762-Safe-Check ↗Trust ok 100

    ★ 0 · created 2026-06-24

  14. AlexLondan/CVE-2024-21762-Fortinet-RCE-ALLWORK ↗Unscored

    seen 2026-10-18

  15. c0d3b3af/CVE-2024-21762-Exploit ↗Unscored

    seen 2026-10-18

  16. c0d3b3af/CVE-2024-21762-POC ↗Unscored

    seen 2026-10-18

  17. c0d3b3af/CVE-2024-21762-RCE-exploit ↗Unscored

    seen 2026-10-18

  18. cleverg0d/CVE-2024-21762-Checker ↗Unscored

    seen 2026-10-18

  19. Codeb3af/Cve-2024-21762- ↗Unscored

    seen 2026-10-18

  20. Gh71m/CVE-2024-21762-POC ↗Unscored

    seen 2026-10-18

  21. JohnHormond/CVE-2024-21762-Fortinet-RCE-WORK ↗Unscored

    seen 2026-10-18

  22. lolminerxmrig/multicheck_CVE-2024-21762 ↗Unscored

    seen 2026-10-18

  23. lore-is-already-taken/multicheck_CVE-2024-21762 ↗Unscored

    seen 2026-10-18

  24. MrCyberSec/CVE-2024-21762-Fortinet-RCE-ALLWORK ↗Unscored

    seen 2026-10-18

  25. redCode001/CVE-2024-21762-POC ↗Unscored

    seen 2026-10-18

  26. RequestXss/CVE-2024-21762-Exploit-POC ↗Unscored

    seen 2026-10-18

  27. S0SkiPlosK1/CVE-2024-21762-POC ↗Unscored

    seen 2026-10-18

  28. t4ril/CVE-2024-21762-PoC ↗Unscored

    seen 2026-10-18

  29. TheRedDevil1/CVE-2024-21762 ↗Unscored

    seen 2026-10-18

  30. tr1pl3ight/CVE-2024-21762-POC ↗Unscored

    seen 2026-10-18

  31. vorotilovaawex/CVE-2024-21762_POC ↗Unscored

    seen 2026-10-18

  32. XiaomingX/cve-2024-21762-poc ↗Unscored

    seen 2026-10-18

  33. zzcentury/FortiGate-CVE-2024-21762 ↗Unscored

    seen 2026-10-18

Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.

On the wire

1 dispatch
  1. RT by @cyb3rops: Update: the Chinese threat actor behind the #Hermes + #CyberStrikeAI + #SliverC2 exploitation node has shifted operations to a new server ( migrated ~19 Jun 2026). Threat actor also hit http://derouter.ai, an AI-API reseller selling Claude/GPT access. Found an endpoint wide open and pulled 775 upstream API-key IDs + their ban/rate-limit status + full traffic data(patched). New infra IOCs: 203.88.119[.]53 — new primary host post-migration 137.220.144[.]253:12305 — Sliver Redirector (also ran its own independent exploit campaign vs 32 targets) 143.92.51.76[:]23175 — WireGuard/SOCKS5 exit node for scan traffic 207.180.56[.]150 — Operator's IP address Domains: 1daynews[.]app/435736b425a677a8 — public-facing CVE-intel dashboard (14,643 CVEs tracked, 20 sources, live-updating) aitoday[.]me — second service Attribution: SSH key artifact leaks username knaithe (knaithe@DESKTOP-IQA5FIU), retained across the migration. Telegram control bot (AAtttttttaccccckBot). Full China-nexus stack — FOFA / DeepSeek / GLM / dnslog[.]cn, internal agent notes all in Chinese. Shodan username via api key: crc2 @malwrhunterteam @500mk500 @MichalKoczwaraKEV

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.