How severe is CVE-2023-33299?

CVE-2023-33299 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2023-33299 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 24% (98th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-33299?

CVE-2023-33299 primarily affects Fortinet Fortinac. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-33299?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2023-33299 published?

CVE-2023-33299 was published on 2023-06-23 and last updated on 2026-06-17.

CVE-2023-33299

CVE-2023-33299 is a critical-severity vulnerability in Fortinet Fortinac with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 24% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-502.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 24% (98th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-502
Affected product: Fortinet Fortinac
Published: 2023-06-23
Last modified: 2026-06-17

Description

A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.

Frequently asked questions

What is CVE-2023-33299?: A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. Note FortiNAC versions 8.x will not be fixed.
How severe is CVE-2023-33299?: CVE-2023-33299 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2023-33299 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 24% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-33299?: CVE-2023-33299 primarily affects Fortinet Fortinac. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-33299?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2023-33299 published?: CVE-2023-33299 was published on 2023-06-23 and last updated on 2026-06-17.

References

https://fortiguard.com/psirt/FG-IR-23-074

Affected products (7)

cpe:2.3:a:fortinet:fortinac:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortinac:7.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortinac:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortinac:8.3.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortinac:9.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortinac:9.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortinac:9.4.2:*:*:*:*:*:*:*

More vulnerabilities in Fortinet Fortinac

CVE-2022-39952 — Critical (CVSS 9.8): A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7,…
CVE-2022-38375 — Critical (CVSS 9.1): An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6…
CVE-2022-26117 — High (CVSS 8.8): An empty password in configuration file vulnerability [CWE-258] in FortiNAC version 8.3.7 and below, 8.5.2 and below,…
CVE-2022-39953 — High (CVSS 7.8): A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.6,…
CVE-2021-43065 — High (CVSS 7.8): A incorrect permission assignment for critical resource in Fortinet FortiNAC version 9.2.0, version 9.1.3 and below,…
CVE-2021-41021 — High (CVSS 7.8): A privilege escalation vulnerability in FortiNAC versions 8.8.8 and below and 9.1.2 and below may allow an admin user…

All CVEs affecting Fortinet Fortinac →

Other CWE-502 (Deserialization of Untrusted Data) vulnerabilities

CVE-2026-41104 — Critical (CVSS 10.0): Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose…
CVE-2026-43633 — Critical (CVSS 10.0): HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a…
CVE-2026-33819 — Critical (CVSS 10.0): Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.
CVE-2026-20131 — Critical (CVSS 10.0): A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could…
CVE-2026-25632 — Critical (CVSS 10.0): EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water…
CVE-2025-14931 — Critical (CVSS 10.0): Hugging Face smolagents Remote Python Executor Deserialization of Untrusted Data Remote Code Execution Vulnerability.…

Browse all CWE-502 (Deserialization of Untrusted Data) vulnerabilities →