Is CVE-2024-23113 being actively exploited?

Yes. CVE-2024-23113 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on October 9, 2024.

What is the CVSS score for CVE-2024-23113?

CVE-2024-23113 has a CVSS 3.1 base score of 9.8 (CRITICAL).

CVE-2024-23113

CRITICAL · CVSS 9.8CISA KEV: actively exploitedEPSS 61.7%EU EUVD: exploited

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

Key facts

CVSS score: 9.8 (v3.1)
Severity: CRITICAL
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-134
EPSS score: 61.7% (99th percentile)
In CISA KEV: Yes, added October 9, 2024
In EU EUVD: Yes (EUVD-2024-20638)
Published: February 15, 2024
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

Fortinet Multiple Products Format String Vulnerability

Added to the KEV catalog on October 9, 2024; federal remediation due October 30, 2024.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2024-20638 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 21, 2025.

View on the EU Vulnerability Database

Affected products

fortinet / fortios
fortinet / fortipam
fortinet / fortipam
fortinet / fortiproxy
fortinet / fortiswitchmanager

Certified products that may be affected

1 FIPS 140 or Common Criteria certified product, from automated matching by sec-certs.org.

Fortinet, Inc. FortiOS 7.0.7 - Fortinet, Inc. - Common Criteria NSCIB-CC-0590233-CR - active

References

https://fortiguard.com/psirt/FG-IR-24-029(Vendor Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23113(US Government Resource)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain