CVE-2021-32589
A Use After Free (CWE-416) vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 and below, version 5.6.10 and below, version 5.4.7 and below, version 5.2.10 and below, version 5.0.12 and below and FortiAnalyzer version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 and below, version 5.6.10 and below, version 5.4.7 and below, version 5.3.11, version 5.2.10 to 5.2.4 fgfmsd daemon may allow a remote, non-authenticated attacker to execute unauthorized code as root via sending a specifically crafted request to the fgfm port of the targeted device.
Key facts
- CVSS score
- 8.1 (v3.1)
- Severity
- HIGH
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
- CWE-416
- EPSS score
- 8.9% (95th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2021-19429)
- Published
- December 19, 2024
- NVD last modified
- June 17, 2026
- Status
- Analyzed
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2021-19429 in the EU Vulnerability Database. Last updated in EUVD on December 20, 2024.
View on the EU Vulnerability DatabaseAffected products
- fortinet / fortianalyzer
- fortinet / fortianalyzer
- fortinet / fortimanager
- fortinet / fortimanager
- fortinet / fortiportal
Certified products that may be affected
2 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- FortiAnalyzer™ Centralized Reporting Appliances running Firmware 5.2.4 - Fortinet, Inc. - Common Criteria 383-4-360 - archived
- FortiManager Appliances running Firmware 5.2.4 - Fortinet, Inc. - Common Criteria 383-4-359 - archived
References
- https://fortiguard.fortinet.com/psirt/FG-IR-21-067(Vendor Advisory)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain