CVE-2024-33507 is a high severity (CVSS 7.4) flaw in the FortiIsolator authentication mechanism. A crafted cookie can sign out logged-in admins without credentials, and can give a read-only user write privilege. Fortinet's fix is 2.4.5 or later on the 2.4 branch, and a migration on 2.3.
What's affected
Per Fortinet advisory FG-IR-24-062, published October 14, 2025:
- FortiIsolator 3.0: not affected.
- 2.4.0 through 2.4.4: upgrade to 2.4.5 or above.
- 2.3: all versions affected. Migrate to a fixed release.
The NVD record also lists 2.2.0 and all 2.1 and 2.0 versions. Treat any branch older than 2.4 as having no patch and plan a move to a supported release. Fortinet found the issue internally and marks it as not known to be exploited. Its listed impact is denial of service.
How to check if you're exposed
Fortinet products show their firmware version on the dashboard or in the command line. On the CLI, the status command prints it:
get system status
Compare the reported version with the affected and fixed versions above. If your branch is listed as migrate to a fixed release, there is no patch on that branch and you need to move to a supported one.
What to do now
- Upgrade 2.4 appliances to 2.4.5 or later, and plan a migration for 2.3 and older.
- Keep the administration interface off the internet and on a management network.
- Review which accounts hold read-only roles and whether they need access at all.
- Check audit logs for unexpected sign-outs or changes made by read-only accounts.
- Document the appliance version in your asset inventory.
Why it matters
Two weaknesses are named: CWE-613, insufficient session expiration, and CWE-863, incorrect authorization. In plain terms the appliance trusts the contents of a cookie more than it should. A forged or altered cookie can end an admin session or change what a user is allowed to do.
The first outcome is a nuisance that becomes serious during an incident, when the people responding get kicked out of the console. The second is a privilege jump from reading to writing configuration on a device whose job is to isolate browsing. Server-side validation of every session attribute is the fix class.
Try it yourself
Advisories on appliances can land with little warning. This demo shows a watch view for newly published issues.
Click through it at your own pace, or open it full screen.
Quick check
Do I need valid credentials for the first attack?
The advisory says a remote unauthenticated attacker can sign out admins using a crafted cookie. The privilege jump needs a read-only account.
Sources
Last reviewed: 19 October 2026.
