CVE-2024-47571 is a high severity (CVSS 8.1) flaw in Fortinet FortiManager where a FortiGate admin account deleted through FortiManager can still log in to the FortiGate with valid credentials. Fortinet lists fixed releases per branch, and a workaround is to delete the account directly on the FortiGate.
What's affected
Fortinet advisory FG-IR-24-239 lists these affected FortiManager versions and fixes:
- FortiManager 7.4: version 7.4.0, upgrade to 7.4.1 or above.
- FortiManager 7.2: version 7.2.3, upgrade to 7.2.4 or above.
- FortiManager 7.0: versions 7.0.7 through 7.0.8, upgrade to 7.0.9 or above.
- FortiManager 6.4: version 6.4.12, upgrade to 6.4.13 or above.
FortiManager 7.6 is listed as not affected. The advisory states Known Exploited: No.
How to check if you're exposed
Read the FortiManager version from the web console or the CLI.
get system status
Compare the version to the list above. Then audit the FortiGates that FortiManager manages. Compare the admin accounts present on each FortiGate with the accounts you believe exist, and look for any that were deleted through FortiManager but still appear on the device. The advisory describes this as the symptom: an account removed in FortiManager that remains usable.
What to do now
- Check the FortiManager version against the Fortinet advisory table.
- Upgrade to the fixed release for your branch.
- Audit admin accounts on every managed FortiGate and remove any stale ones directly on the device.
- Until you have upgraded, delete admin accounts directly on the FortiGate as the workaround suggests, instead of through FortiManager.
- Rotate credentials for any admin account that was removed in the past and may still exist.
Why it matters
The weakness is CWE-672 (Operation on a Resource after Expiration or Release). In plain terms, a resource that should be gone, here an administrator account, is still honoured. A central manager says the account was deleted, but the managed device still accepts its credentials.
This kind of flaw hides well because the console looks clean. It matters most in organisations where staff turn over and offboarding is done through a central tool. Fortinet says the issue is not known to be exploited, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-47571.
Quick check
What is the quickest mitigation?
Fortinet suggests deleting the admin account directly on the FortiGate when that is the intent.
Is FortiManager 7.6 affected?
Fortinet lists 7.6 as not affected.
Sources
Last reviewed: 19 October 2026.
