CVE-2023-44250 is a high severity (CVSS 8.8) improper privilege management flaw in FortiOS and FortiProxy high availability clusters. An authenticated attacker can perform elevated actions through crafted HTTP or HTTPS requests. Fortinet fixed it in FortiOS 7.4.2 and 7.2.6, and FortiProxy 7.4.2.
What's affected
Fortinet's advisory FG-IR-23-315 lists these as affected: FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.5, and FortiProxy 7.4.0 through 7.4.1. Fixed releases are FortiOS 7.4.2 or later, FortiOS 7.2.6 or later, and FortiProxy 7.4.2 or later. FortiOS 7.0 and 6.4 and the older FortiProxy lines are not affected. The record lists the same versions.
Severity agrees. Fortinet gives a CVSS v3 base score of 8.8, and the record shows the same score with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The advisory lists the impact as unauthorized code or command execution and does not mark it as known exploited. The record's KEV flag is false. The weakness is CWE-269, improper privilege management.
The attacker must be authenticated and uses requests to the web administrative interface. Fortinet mentions a virtual patch signature in an intrusion prevention update, named FortiOS.HA.RestAPI.Privilege.Elevation, but lists no other workaround.
How to check if you're exposed
- On the FortiGate or FortiProxy, run
get system statusand read the Version line. - Check whether the unit is part of an HA cluster.
get system ha statusshows the cluster state. - If you run 7.4.0 to 7.4.1 or FortiOS 7.2.5 in HA, you are in scope.
- Check who can reach the web administrative interface and which accounts exist.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- Upgrade FortiOS to 7.4.2 or later, or to 7.2.6 or later on the 7.2 line. Upgrade FortiProxy to 7.4.2 or later.
- Restrict the administrative interface to trusted hosts and a management network.
- Review administrator and API accounts, and remove unneeded ones.
- Check Fortinet's advisory for the virtual patch details if you cannot upgrade immediately.
- Plan the HA upgrade in the order Fortinet's upgrade guide specifies.
Why it matters
Improper privilege management means the software gives a user more rights than they should have, or does not limit what a lower privileged account can do. Here, a user who can log in can reach elevated actions through the REST interface in an HA cluster.
Firewalls and proxies are high value because they guard the network edge. Even a flaw that needs a login is worth fixing quickly, since administrative accounts can be phished or reused. Fortinet products have had exploited flaws in the past, but this one is not marked as exploited by Fortinet or by CISA's catalogue in the record.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which releases fix it?
FortiOS 7.4.2 or later, FortiOS 7.2.6 or later, and FortiProxy 7.4.2 or later, per Fortinet.
Does it only affect HA clusters?
The advisory describes it as a flaw in HA clusters. Check the advisory if you run a single unit.
Sources
Last reviewed: 19 October 2026.
