Fortinet SSL VPN flaw CVE-2024-21762 still draws active exploits as the workweek begins
Marcus Webb ·
Attackers are still exploiting Fortinet FortiOS SSL VPN devices vulnerable to CVE-2024-21762 as of Monday, July 13. The remote code execution flaw has been under active exploitation since February 2024, and exposed appliances remain a reliable entry point for both state aligned operators and e crime groups. The risk is immediate because compromise at the edge often leads to credential theft and rapid lateral movement.
This matters now because exploit traffic against internet facing VPN portals does not abate over weekends. Open telemetry sources have shown steady scans and opportunistic attempts since disclosure, and ransomware affiliates have a track record of pivoting from network edge bugs to domain wide impact in hours.
Why this matters today
CVE-2024-21762 affects FortiOS SSL VPN and allows an unauthenticated attacker to execute code on targeted appliances. Fortinet released fixed FortiOS builds and mitigations in February 2024, and later advised customers to treat unpatched devices as potentially compromised. Older Fortinet SSL VPN flaws, including CVE-2018-13379, have been used by LockBit and Akira affiliates, and defenders should assume similar tradecraft when this bug is in play.
Successful exploitation typically precedes the creation of new local admin users, credential harvesting from memory, and outbound command and control from the appliance. From there, actors attempt domain authentication replay, remote service creation, and deployment of tools like Cobalt Strike or Sliver inside the network.
What defenders should do
Immediately verify FortiOS versions against Fortinet’s advisory for CVE-2024-21762 and install the fixed releases. If patching is not immediately possible, disable the SSL VPN portal or restrict access by source IP, place the device behind an access proxy, and enable strict MFA for all remote access.
Assume breach for any device that was exposed and not fully remediated. Review appliance logs for sslvpn daemon crashes, unexpected configuration changes, and the creation of new or modified administrative accounts. Check for unusual logins from unfamiliar public IP addresses, unknown scheduled tasks, and outbound connections from the appliance to cloud VPS providers.
Rotate VPN and local admin credentials, invalidate existing sessions, and reissue device certificates after patching. Hunt for lateral movement by querying for remote service installations, PsExec style connections, and use of archiving utilities on file servers in the 24 to 72 hours following VPN portal activity.
Edge devices remain the shortest path from internet scanning to domain persistence, and they concentrate risk in widely deployed platforms. Vendors are under pressure to harden management planes and deliver safer defaults, but organizations that run internet facing appliances must treat weekend patch windows and continuous monitoring as table stakes.