CVE-2024-50563 is a high severity (CVSS 7.3) weak authentication flaw in the Security Fabric csfd daemon of FortiManager and FortiAnalyzer 7.4 and 7.6, including their cloud editions. Brute force could bypass authentication and reach a restricted set of features. Upgrade per advisory FG-IR-24-221.
What's affected
Fortinet advisory FG-IR-24-221 lists these affected versions and fixes:
- FortiManager 7.6.0 through 7.6.1: upgrade to 7.6.2 or above.
- FortiManager 7.4.1 through 7.4.3, and FortiManager Cloud 7.4.1 through 7.4.3: upgrade to 7.4.4 or above.
- FortiAnalyzer 7.6.0 through 7.6.1: upgrade to 7.6.2 or above.
- FortiAnalyzer 7.4.1 through 7.4.3, and FortiAnalyzer Cloud 7.4.1 through 7.4.3: upgrade to 7.4.4 or above.
FortiManager and FortiAnalyzer 7.2 and 7.0 are listed as not affected. The advisory describes that for FortiManager the attacker may access a restricted list of features.
How to check if you're exposed
Check the version from the console.
get system status
Then look at the Security Fabric settings, and check whether the group password is long and random. The advisory suggests a password of at least 20 characters, randomly generated, as a workaround, or disabling the fabric.
What to do now
- Read each device version and compare to the advisory table.
- Upgrade to the fixed version for your branch.
- Set a strong random group password of at least 20 characters if you cannot upgrade yet.
- Disable the Security Fabric where it is not in use.
- Allow fabric traffic only from known devices and networks.
Why it matters
The weakness is CWE-1390 (Weak Authentication). The fabric authentication can be guessed through repeated attempts, and the record says the outcome is access to restricted features on FortiManager. This is the same family of problem as CVE-2024-48886, which affects other Fortinet products from the same advisory and has a higher score.
Central management tools control many other devices, so even a limited foothold on one can be worth a lot to an attacker. Fortinet marks Known Exploited as No, and the CVE is not on the KEV list. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that you can use to check manifests for known CVEs, and the Gold directory lists this one at https://gold.safeguard.sh/vulnerability/CVE-2024-50563.
Quick check
How is this different from CVE-2024-48886?
Both come from advisory FG-IR-24-221. This one is the FortiManager and FortiAnalyzer side, and the other covers FortiOS and FortiProxy.
What is the workaround?
A random group password of at least 20 characters, or turning off the Security Fabric.
Sources
Last reviewed: 19 October 2026.
