How severe is CVE-2024-47571?

CVE-2024-47571 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2024-47571 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-47571?

CVE-2024-47571 primarily affects Fortinet Fortimanager. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-47571?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2024-47571 have an EU (EUVD) identifier?

Yes. CVE-2024-47571 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-42864.

When was CVE-2024-47571 published?

CVE-2024-47571 was published on 2025-01-14 and last updated on 2026-06-17.

CVE-2024-47571

CVE-2024-47571 is a high-severity vulnerability in Fortinet Fortimanager with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-672.

Key facts

Severity: High (CVSS 3.x base score 8.1)
EPSS exploit prediction: 1% (55th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-42864
Weakness: CWE-672
Affected product: Fortinet Fortimanager
Published: 2025-01-14
Last modified: 2026-06-17

Description

An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12 through 7.4.0 allows an attacker to gain improper access to FortiGate via valid credentials.

Frequently asked questions

What is CVE-2024-47571?: An operation on a resource after expiration or release in Fortinet FortiManager 6.4.12 through 7.4.0 allows an attacker to gain improper access to FortiGate via valid credentials.
How severe is CVE-2024-47571?: CVE-2024-47571 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2024-47571 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-47571?: CVE-2024-47571 primarily affects Fortinet Fortimanager. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-47571?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-47571 have an EU (EUVD) identifier?: Yes. CVE-2024-47571 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-42864.
When was CVE-2024-47571 published?: CVE-2024-47571 was published on 2025-01-14 and last updated on 2026-06-17.

References

https://fortiguard.fortinet.com/psirt/FG-IR-24-239

Affected products (4)

cpe:2.3:a:fortinet:fortimanager:*:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimanager:6.4.12:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimanager:7.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortimanager:7.4.0:*:*:*:*:*:*:*

More vulnerabilities in Fortinet Fortimanager

CVE-2026-24858 — Critical (CVSS 9.8): An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet…
CVE-2023-25610 — Critical (CVSS 9.8): A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version…
CVE-2024-47575 — Critical (CVSS 9.8): A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager…
CVE-2015-3613 — Critical (CVSS 9.8): A vulnerability exists in in FortiManager 5.2.1 and earlier and 5.0.10 and earlier in the WebUI FTP backup page
CVE-2019-6695 — Critical (CVSS 9.8): Lack of root file system integrity checking in Fortinet FortiManager VM application images of 6.2.0, 6.0.6 and below…
CVE-2024-48886 — Critical (CVSS 9.0): A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15,…

All CVEs affecting Fortinet Fortimanager →

Other CWE-672 (Operation on a Resource after Expiration or Release) vulnerabilities

CVE-2023-41094 — Critical (CVSS 10.0): TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing…
CVE-2020-24030 — Critical (CVSS 9.8): ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and…
CVE-2020-12043 — Critical (CVSS 9.8): The Baxter Spectrum WBM (v17, v20D29, v20D30, v20D31, and v22D24) when configured for wireless networking the FTP…
CVE-2019-17638 — Critical (CVSS 9.4): In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an…
CVE-2013-10075 — Critical (CVSS 9.1): Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores…
CVE-2022-22755 — High (CVSS 8.8): By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute…

Browse all CWE-672 (Operation on a Resource after Expiration or Release) vulnerabilities →