CVE-2024-26008: Fortinet FortiOS DOS Vulnerability

CVE-2024-26008 Overview

CVE-2024-26008 is an improper check or handling of exceptional conditions vulnerability [CWE-703] affecting the fgfm daemon in multiple Fortinet products. An unauthenticated remote attacker can repeatedly reset the fgfm connection by sending crafted SSL-encrypted TCP requests. The flaw impacts FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager across several release branches. Fortinet published the advisory under reference FG-IR-24-041. The issue affects the availability of the FortiGate-to-FortiManager (FGFM) management channel, which can disrupt centralized management operations. The vulnerability does not compromise confidentiality or integrity of data. The National Vulnerability Database published the entry on 2025-10-14.

Critical Impact
Unauthenticated attackers can repeatedly reset the fgfm management connection, degrading centralized management availability for affected Fortinet appliances.

Affected Products

FortiOS 7.4.0 through 7.4.3 and versions before 7.2.7
FortiProxy 7.4.0 through 7.4.3 and versions before 7.2.9; FortiPAM before 1.2.0
FortiSwitchManager 7.2.0 through 7.2.3 and 7.0.0 through 7.0.3

Discovery Timeline

2025-10-14 - CVE-2024-26008 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-26008

Vulnerability Analysis

The fgfm daemon implements the FortiGate-to-FortiManager protocol used for centralized device management. The daemon terminates SSL-encrypted TCP connections from managed devices and management servers. When it receives specific crafted SSL-encrypted TCP requests, the daemon fails to properly handle the exceptional condition and resets the active connection. An unauthenticated remote attacker can repeat the request to keep the connection in a reset loop. This produces a targeted availability impact against the management channel without affecting data confidentiality or integrity. The flaw is categorized under CWE-754: Improper Check for Unusual or Exceptional Conditions.

Root Cause

The root cause is missing or incorrect handling of exceptional conditions during SSL-encrypted TCP request processing inside the fgfm daemon. The daemon does not distinguish malformed or unexpected inputs from legitimate protocol traffic. Instead of gracefully rejecting the request, it tears down the established connection. Because no authentication is required prior to reaching this code path, any network-reachable attacker can trigger it.

Attack Vector

Exploitation requires network access to the fgfm service port on an affected Fortinet appliance. The attacker sends crafted SSL-encrypted TCP requests that trigger the exceptional condition. Repeating the request keeps the fgfm session in a reset state, denying management traffic between the FortiGate device and FortiManager. No user interaction, credentials, or prior foothold are required.

No public proof-of-concept code has been published for CVE-2024-26008. Refer to the Fortinet Security Advisory FG-IR-24-041 for authoritative technical details.

Detection Methods for CVE-2024-26008

Indicators of Compromise

Repeated TCP resets or short-lived SSL sessions targeting the fgfm service port on FortiGate, FortiProxy, FortiPAM, or FortiSwitchManager appliances.
Frequent reconnection events in FortiManager logs from managed devices without configuration or network changes to explain them.
Bursts of inbound SSL traffic to fgfm from unexpected source addresses outside the management network.

Detection Strategies

Monitor fgfm daemon logs on affected appliances for repeated connection reset events and correlate with source IP addresses.
Baseline normal FGFM session duration and alert on statistically significant drops or high reconnection rates.
Deploy network intrusion detection signatures that flag anomalous SSL handshake patterns aimed at the fgfm port.

Monitoring Recommendations

Forward FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager syslog to a centralized SIEM for correlation of fgfm availability events.
Track uptime and session health of the FGFM tunnel using SNMP or the FortiManager device status API.
Alert security operations when management-plane connectivity to a device drops repeatedly within a short window.

How to Mitigate CVE-2024-26008

Immediate Actions Required

Upgrade affected products to fixed releases as listed in Fortinet Security Advisory FG-IR-24-041.
Restrict inbound access to the fgfm service port to trusted FortiManager IP addresses using local-in policies or upstream firewall rules.
Inventory FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager instances and confirm running versions against the affected version ranges.

Patch Information

Fortinet has released updated firmware that resolves CVE-2024-26008. Upgrade FortiOS to 7.4.4 or later and to 7.2.7 or later; FortiProxy to 7.4.4 or later and to 7.2.9 or later; FortiPAM to 1.2.0 or later; and FortiSwitchManager to versions above 7.2.3 and 7.0.3. Consult Fortinet Security Advisory FG-IR-24-041 for the authoritative fixed-version matrix.

Workarounds

Limit the fgfm service exposure to only known FortiManager management IP addresses via local-in policies.
Place management interfaces on a dedicated out-of-band network segment unreachable from untrusted zones.
Monitor for repeated fgfm resets and rate-limit or block offending source addresses at the network perimeter.

bash

# Example FortiOS local-in policy to restrict fgfm access to trusted management hosts
config firewall address
    edit "FortiManager-Trusted"
        set subnet 10.10.10.0 255.255.255.0
    next
end

config firewall local-in-policy
    edit 1
        set intf "wan1"
        set srcaddr "FortiManager-Trusted"
        set dstaddr "all"
        set action accept
        set service "ALL"
        set schedule "always"
    next
    edit 2
        set intf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action deny
        set service "ALL"
        set schedule "always"
    next
end