CVE-2024-35276 is a medium severity (CVSS 5.6) stack-based buffer overflow in Fortinet FortiManager and FortiAnalyzer, including the Cloud editions. Specially crafted packets can lead to code execution as a low privileged user. Fix by upgrading to 7.4.4, 7.2.6, 7.0.13 or 6.4.15 or later.
What's affected
Per Fortinet advisory FG-IR-24-165, published January 14, 2025. The same ranges apply to FortiManager and FortiAnalyzer:
- 7.6: not affected.
- 7.4.0 through 7.4.3: upgrade to 7.4.4 or above.
- 7.2.0 through 7.2.5: upgrade to 7.2.6 or above.
- 7.0.0 through 7.0.12: upgrade to 7.0.13 or above.
- 6.4.0 through 6.4.14: upgrade to 6.4.15 or above.
For the Cloud editions: 7.4.1 through 7.4.3 go to 7.4.4, 7.2.1 through 7.2.5 go to 7.2.6, 7.0.1 through 7.0.11 go to 7.0.12, and all 6.4 versions need a migration. Fortinet found the issue internally and lists it as not known to be exploited.
How to check if you're exposed
Fortinet products show their firmware version on the dashboard or in the command line. On the CLI, the status command prints it:
get system status
Compare the reported version with the affected and fixed versions above. If your branch is listed as migrate to a fixed release, there is no patch on that branch and you need to move to a supported one.
Check each FortiManager and FortiAnalyzer unit, including virtual machines and any Cloud instances.
What to do now
- Upgrade FortiManager and FortiAnalyzer to the fixed release for your branch.
- Migrate Cloud 6.4 instances to a fixed release, since no patch exists on that branch.
- Restrict network access to the management plane to trusted hosts.
- Review administrator profiles and remove any that are not needed.
- Re-check the products after upgrade and keep them on a version that still receives fixes.
Why it matters
The class is CWE-121, stack-based buffer overflow, which falls under CWE-787, out-of-bounds write. A packet handler copies more data than a fixed-size stack buffer can hold, and the extra bytes overwrite memory the program depends on.
The score is moderate because modern memory protections make reliable exploitation hard, which the high attack complexity reflects. The code runs as a low privileged user. That still matters on these products, since they hold device configurations and logs for a whole Fortinet estate. A quick upgrade is the answer, since no workaround is listed in the sources fetched.
Try it yourself
When a fixed version exists, the useful question is which of your assets can take it today. This demo shows that view.
Click through it at your own pace, or open it full screen.
Quick check
Does the same fix cover FortiAnalyzer and FortiManager?
Yes. The advisory lists the same affected ranges and fixed versions for both, with separate Cloud lines.
Sources
Last reviewed: 19 October 2026.
