CVE-2024-23113

Fortinet products allow remote, unauthenticated attackers to execute arbitrary code via a format string vulnerability.

This unpatched format string flaw enables remote code execution in FortiOS, FortiPAM, FortiProxy, and FortiWeb, directly threatening DIB systems that rely on these components for security and management. Because the vulnerability is actively exploited and allows unauthenticated remote code execution, it poses an immediate risk to FedRAMP and NIST 800-171 environments unless patched immediately.

Shame score — A high-severity, actively exploited RCE vulnerability in widely deployed security products indicates a critical failure in patch management and security posture.