CVE-2024-48886

A weak authentication in Fortinet FortiOS versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.8, 7.0.0 through 7.0.15, 6.4.0 through 6.4.15, FortiProxy versions 7.4.0 through 7.4.4, 7.2.0 through 7.2.10, 7.0.0 through 7.0.17, 2.0.0 through 2.0.14, FortiManager versions 7.6.0 through 7.6.1, 7.4.1 through 7.4.3, FortiManager Cloud versions 7.4.1 through 7.4.3, FortiAnalyzer Cloud versions 7.4.1 through 7.4.3 allows attacker to execute unauthorized code or commands via a brute-force attack.

Scoring

Severity

HIGH

CVSS base score

8

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:R

EPSS probability

0.48%

CWE

CWE-1390

Published

2025-01-14

Last modified

2026-03-13

Affected products

• Fortinet FortiOS
• Fortinet FortiOS
• Fortinet FortiOS
• Fortinet FortiOS
• Fortinet FortiProxy
• Fortinet FortiProxy
• Fortinet FortiProxy
• Fortinet FortiProxy

Weakness type

• CWE-1390

Related vulnerabilities

• CVE-2026-77483 — SQL Server Elevation of Privilege Vulnerability
• CVE-2026-73025 — Windows iSCSI Security Feature Bypass Vulnerability
• CVE-2026-62895 — Azure Arc SQL Server Extension Elevation of Privilege Vulnerability
• CVE-2026-80219 — Hawtio-operator: hawtio-operator: oauthclient created with grantmethod auto and no secret enables oauth token theft
• CVE-2026-73819 — Ebyte NA111-M Weak Authentication
• CVE-2026-44476 — Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret
• CVE-2026-65098 — NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an...
• CVE-2026-68067 — Mira Hormone Monitor, Mira Android App Weak Authentication

Markdown version · Browse all CVEs