New Fortinet RCE flaw in SSL VPN likely exploited in attacks

Fortinet disclosed a critical FortiOS SSL VPN vulnerability (CVE-2024-21762, severity 9.6) — an unauthenticated out-of-bounds write that can lead to remote code execution — and published upgrade paths and a mitigation (disable SSL VPN) for affected versions; while there are no confirmed reports of active exploitation for this CVE, the advisory references the high-risk context of FortiOS-targeting actors (including the Volt Typhoon APT and the COATHANGER RAT) and urges immediate patching.