CVE-2023-46714 is a high severity (CVSS 7.2) stack-based buffer overflow in the FortiOS administrative interface. Versions 7.2.1 through 7.2.7 and 7.4.0 through 7.4.1 are affected. Upgrade to 7.2.8 or 7.4.2 or later. A privileged attacker could run code via crafted HTTP or HTTPS requests.
What's affected
The Fortinet advisory FG-IR-23-415 lists FortiOS 7.4.0 through 7.4.1, fixed in 7.4.2 or above, and 7.2.1 through 7.2.7, fixed in 7.2.8 or above. It says 7.0 and 6.4 are not affected. The record agrees on the 7.2 and 7.4 branches but states the 7.2 range as 7.2.1 through 7.2.6, so the advisory's 7.2.7 upper bound is the safer one.
Fortinet rates it Medium with a base score of 7.2 and a temporal score of 6.8. NVD labels the same score High. The advisory lists a virtual patch, FG-VD-54575.0day, in FMWP database update 24.011. The weakness is CWE-121.
The NVD record scores it 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The weakness class is CWE-121 (stack-based buffer overflow). The record does not list this CVE in the CISA Known Exploited Vulnerabilities catalog, and nothing we read says it is exploited in the wild.
How to check if you're exposed
On the FortiGate command line:
get system status
Read the Version line and compare it with the ranges above. Then check whether the administrative interface is reachable from untrusted networks. The attacker needs privileged access to the admin interface according to the record.
What to do now
- Upgrade FortiOS to 7.2.8 or later, or 7.4.2 or later, using the Fortinet upgrade path tool.
- Restrict administrative access to trusted hosts and management networks.
- Enable the virtual patch from the FMWP database update if you cannot upgrade at once.
- Review admin accounts and login history.
- Record the FortiOS version on each device.
Why it matters
A stack-based buffer overflow occurs when a function writes more data to a fixed buffer than fits, overwriting adjacent memory. In a network appliance that runs as a privileged process, this can lead to code execution.
The need for a privileged login lowers the risk, but firewall admin interfaces have been targeted often, and a flaw like this is useful once credentials are stolen. Keeping the admin interface off the internet removes most of the exposure.
Quick check
Which branches are not affected?
Fortinet says 7.0 and 6.4 are not affected.
Is there a virtual patch?
Fortinet lists FG-VD-54575.0day in FMWP database update 24.011.
Sources
Last reviewed: 19 October 2026.
