CVE-2024-48886 is a critical severity (CVSS 9.0) weak authentication flaw in the Security Fabric csfd daemon of FortiOS, FortiProxy and related Fortinet products. An unauthenticated attacker with fabric network access could brute force the process. Upgrade per advisory FG-IR-24-221, or use a strong group password.
What's affected
Fortinet advisory FG-IR-24-221 lists, for the products in this record:
- FortiOS 7.4.0 through 7.4.4: upgrade to 7.4.5. FortiOS 7.2.0 through 7.2.8: upgrade to 7.2.9. FortiOS 7.0.0 through 7.0.15: upgrade to 7.0.16. FortiOS 6.4, all versions: migrate to a fixed release. FortiOS 7.6 is not affected.
- FortiProxy 7.4.0 through 7.4.4: upgrade to 7.4.5. FortiProxy 7.2.0 through 7.2.10: upgrade to 7.2.11. FortiProxy 7.0.0 through 7.0.17: upgrade to 7.0.18. FortiProxy 2.0.0 through 2.0.14: upgrade to 2.0.15.
- FortiManager and FortiAnalyzer 7.6.0 through 7.6.1: upgrade to 7.6.2. FortiManager, FortiAnalyzer and their cloud editions 7.4.1 through 7.4.3: upgrade to 7.4.4.
The advisory states that for FortiManager the same kind of flaw may let an attacker bypass authentication and reach a restricted list of features. That is tracked as CVE-2024-50563.
How to check if you're exposed
Read the version on each device, and read the Security Fabric settings.
get system status
show system csf
Look at whether the fabric is enabled, which interfaces allow fabric access, and whether the group password is short or reused. The advisory workaround is a randomly generated group password of at least 20 characters, or turning the fabric off.
What to do now
- Upgrade each device to the fixed version listed for its branch, using the Fortinet upgrade tool.
- Migrate FortiOS 6.4 devices to a supported release, since that branch has no in-branch fix.
- Set a randomly generated group password of at least 20 characters in the fabric settings, as a workaround.
- Turn off the Security Fabric where you do not use it.
- Block fabric traffic from untrusted networks at the edge and at host firewalls.
- Watch for repeated authentication attempts on fabric ports.
Why it matters
The weakness is CWE-1390 (Weak Authentication), meaning the authentication in the Security Fabric protocol is not strong enough to resist guessing. Without limits or a strong secret, an attacker who can reach the port can try many values until one works, and then take control of devices in the fabric.
The critical score comes from network access with no login required, and changed scope since one device can lead to others. The advisory says an attacker needs access to the fabric interface and port, which is the main control to apply. Fortinet marks Known Exploited as No, and it is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-48886.
Quick check
What is the workaround for CVE-2024-48886?
Fortinet says to use a strong group password of at least 20 characters, randomly generated, or to disable the Security Fabric.
Which release fixes FortiOS 7.4?
Fortinet says upgrade to 7.4.5 or above for FortiOS 7.4.0 through 7.4.4.
Sources
Last reviewed: 19 October 2026.
