CVE-2024-48884 is a high severity (CVSS 7.5) path traversal in several Fortinet products, including FortiOS, FortiProxy and FortiManager. An authenticated attacker with access to the security fabric interface could write arbitrary files, and an unauthenticated one could delete a folder. Upgrade as advisory FG-IR-24-259 describes.
What's affected
Fortinet advisory FG-IR-24-259 lists affected versions and fixes for this CVE and for CVE-2024-48885. For the products in this record:
- FortiOS 7.6.0: upgrade to 7.6.1 or above. FortiOS 7.4.0 through 7.4.4: upgrade to 7.4.5. FortiOS 7.2.0 through 7.2.9: upgrade to 7.2.10. FortiOS 7.0.0 through 7.0.15: upgrade to 7.0.16. FortiOS 6.4.0 through 6.4.15: upgrade to 6.4.16.
- FortiProxy 7.4.0 through 7.4.5: upgrade to 7.4.6. FortiProxy 7.2.0 through 7.2.11: upgrade to 7.2.12. FortiProxy 7.0.0 through 7.0.18: upgrade to 7.0.19. FortiProxy 2.0, 1.2, 1.1 and 1.0: migrate to a fixed release.
- FortiManager 7.6.0 through 7.6.1: upgrade to 7.6.2. FortiManager 7.4.1 through 7.4.3, and FortiManager Cloud 7.4.1 through 7.4.3: upgrade to 7.4.4.
FortiRecorder, FortiVoice and FortiWeb are also covered in the advisory, so read the full table for those. Fortinet says FortiSASE was remediated in version 24.3.c with no customer action needed.
How to check if you're exposed
Read the version from each device and compare it to the table.
get system status
Then check whether the Security Fabric is turned on and on which interfaces. The advisory workaround refers to the fabric setting and to the interface access list, so these are the places to look. If the fabric is disabled and no interface allows fabric access, the exposed surface is smaller.
What to do now
- Inventory every Fortinet device and note its model and version.
- Upgrade to the fixed release for each branch using the Fortinet upgrade tool.
- Where you cannot upgrade immediately, apply the advisory workaround by disabling the Security Fabric, or removing fabric access from the interface settings.
- Restrict management and fabric interfaces to trusted networks only.
- Review device logs around file writes and folder deletions on management interfaces.
Why it matters
The weakness is CWE-22 (Path Traversal). The product builds a file path from input without limiting it to the intended directory, so path sequences can step outside it. Depending on the request, the result is writing files or deleting a folder where the attacker should have no access.
The advisory ties the issue to the security fabric interface and port, which are meant for device to device traffic and should not face untrusted networks. Fortinet marks Known Exploited as No, and the CVE is not on the KEV list. Fortinet devices are common targets in general, which is a reason to patch even where a given bug is not yet used. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-48884.
Quick check
Is there a workaround for CVE-2024-48884?
Fortinet describes disabling the Security Fabric, or removing fabric access from the interface settings, as a workaround.
Is it exploited in the wild?
Fortinet marks Known Exploited as No, and it is not on the CISA KEV list.
Sources
Last reviewed: 19 October 2026.
