Fortinet Warns of Critical FortiOS SSL VPN Flaw Likely Under Active Exploitation

Fortinet disclosed CVE-2024-21762, a critical (CVSS 9.6) out-of-bounds write in FortiOS SSL VPN enabling unauthenticated remote code execution; CISA confirmed active exploitation and added it to its Known Exploited Vulnerabilities catalog, and Fortinet has published patches and mitigation guidance across multiple affected releases. The report also contextualizes this zero-day amid ongoing exploitation of Fortinet flaws by state-linked actors (including references to Volt Typhoon) targeting critical infrastructure, underscoring urgent patching and remediation.