CVE-2024-55594 is a medium severity flaw (CVSS 5.6) in Fortinet FortiWeb. Crafted HTTP or HTTPS requests with a malformed structure can get past web firewall protections. On 7.4.0 through 7.4.6 the fix is to upgrade to 7.4.7 or later and then switch on the extra protection steps Fortinet lists in its advisory.
What's affected
Fortinet's advisory FG-IR-23-115 gives the version picture by release branch:
- FortiWeb 7.6 and 6.4: not affected.
- FortiWeb 7.4: 7.4.0 through 7.4.6 are affected. Upgrade to 7.4.7 or above.
- FortiWeb 7.2: all versions are affected. Migrate to a fixed release.
- FortiWeb 7.0: all versions are affected. Migrate to a fixed release.
The NVD record words the ranges differently, listing 7.2.0 through 7.2.10 and 7.0.0 through 7.0.10. The vendor page is the one to trust when the two disagree, and it says every 7.2 and 7.0 release is in scope. The same advisory also covers a second, related flaw, CVE-2023-42784.
How to check if you're exposed
Start with the version. On the FortiWeb command line, this prints the firmware version and build:
get system status
Compare it to the table above. A 7.6 or 6.4 appliance is outside the advisory. A 7.4 appliance below 7.4.7 needs the upgrade, and anything on 7.2 or 7.0 needs a migration plan.
Then check whether the protection from the advisory is actually enabled. Fortinet marks these as mandatory steps to turn the fix on, so a patched appliance that skips them may not be protected. The steps are in the advisory itself, and you should follow them there rather than from a summary.
What to do now
- Record the FortiWeb version and branch on every appliance, including lab and disaster recovery units.
- Upgrade 7.4 appliances to 7.4.7 or later. Plan a migration to a fixed release for 7.2 and 7.0.
- Follow the mandatory steps in FG-IR-23-115 to enable the fix: update the FortiGuard Distribution Service signature set, approve the signature the advisory names, and enable it in the web protection profile.
- Create the File Security rule and policy that the advisory describes, with signature detection turned on, and attach it to the profile.
- Test a known good application through the appliance before and after the change, so a policy mistake does not cause an outage.
- Review web firewall and application logs from before the upgrade for requests that look malformed or that you cannot explain.
Why it matters
The weakness is classed as CWE-228, improper handling of syntactically invalid structure. A security device has to parse a request the same way the application behind it does. When the device and the server disagree about what a malformed request means, a request can look harmless to the filter and still be read differently by the backend. That gap is how a web firewall gets bypassed.
The score is medium because the attack is not trivial. The vector in the record marks attack complexity as high, and it shows limited impact to confidentiality, integrity and availability. Fortinet's advisory says the flaw is not known to be exploited, and the record's KEV flag is false. A web application firewall is still the control many teams count on in front of older applications, so a bypass deserves a prompt upgrade even at this score.
Quick check
Is CVE-2024-55594 exploited in the wild?
Fortinet's advisory lists it as not known to be exploited, and it is not in the CISA Known Exploited Vulnerabilities catalog at the time of this review. Recheck both before you set your own priority.
Is upgrading to 7.4.7 enough?
Fortinet lists mandatory steps to enable the fix, including a signature and a File Security policy. Treat the upgrade and those steps as one change.
Sources
Last reviewed: 19 October 2026.
