CVE-2023-44247 is a medium severity (CVSS 6.6) double free vulnerability in Fortinet FortiOS 6.4, all versions. A privileged attacker could run code or commands through crafted HTTP or HTTPS requests. Fortinet says to migrate to a fixed release and names no specific version.
What's affected
Fortinet's advisory FG-IR-23-195 says FortiOS 6.4 is affected in all versions, and that FortiOS 7.0, 7.2 and 7.4 are not affected. The solution is to migrate to a fixed release. The advisory names no specific version and points to Fortinet's upgrade tool for the recommended upgrade path. No workarounds are listed.
Severity agrees. Fortinet rates it Medium, with a CVSS v3 base score of 6.6, and the record shows the same score and vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. The attacker must be privileged, meaning authenticated with high privileges. The weakness is CWE-415, double free. The advisory does not list it as known exploited, and the record's KEV flag is false.
How to check if you're exposed
- Log in to the FortiGate and run
get system status. The Version line shows the FortiOS release. - Any 6.4 release is affected.
- Check which administrators exist and who can reach the web administrative interface.
- Visit Fortinet's upgrade tool at docs.fortinet.com/upgrade-tool for the path from your release.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- Plan an upgrade from 6.4 to a supported release, using Fortinet's upgrade tool for the recommended path.
- Limit access to the administrative interface to a management network and trusted hosts.
- Review administrator accounts, remove unused ones and use strong authentication for the rest.
- Read the full advisory FG-IR-23-195 for the exact fixed release for your hardware.
- Track the end of support dates for 6.4 in your asset plan.
Why it matters
A double free means a program releases the same block of memory twice. The memory allocator's records get corrupted, and a skilled attacker may turn that into control of the program. It is a memory safety bug, common in C and C++ code.
The score is held down because the attacker needs administrator level privileges and the attack complexity is high. The advice is still to move off FortiOS 6.4 because the advisory offers no fixed 6.4 release and no workaround, so the migration is the fix.
Quick check
Is FortiOS 7.2 affected by this CVE?
No. Fortinet says 7.0, 7.2 and 7.4 are not affected. Only 6.4 is.
Is there a workaround?
The advisory lists none. Upgrade as the advisory directs.
Sources
Last reviewed: 19 October 2026.
