Fortinet has released a security update to fix vulnerabilities in FortiOS and FortiProxy software, addressing CVE-2024-26006 and CVE-2024-26015 which are actively exploited.

Affected Systems

The following systems are affected but not limited to:

• FortiOS version: 7.4.0 through 7.4.3.

• FortiOS Version: 7.2.0 through 7.2.7.

• FortiOS Version: 7.0.0 through 7.0.13.

• FortiProxy Version: 7.4.0 through 7.4.3.

• FortiProxy Version: 7.2.0 through 7.2.9.

• FortiProxy Version: 7.0.0 through 7.0.16.

Security Risks

The successful exploitation of vulnerabilities in FortiOS and FortiProxy software poses a significant security risk, enabling cyber threat actors to gain unauthorized control over affected systems.

Recommended Actions

The National Cyber Security Authority (NCSA) strongly recommends to system administrators to:

• Follow Fortinet Security Advisories to lower the risk of potential exploits, protect systems, and ensure their security.

• Apply the required and latest security updates as soon as possible.

     The released software versions for upgrade include, but are not limited to:

• FortiOS version: 7.4.4 or above.

• FortiOS Version: 7.2.8 or above.

• FortiOS Version: 7.0.14 or above.

• FortiProxy Version: 7.4.4 or above.

• FortiProxy Version: 7.2.10 or above.

• FortiProxy Version: 7.0.17 or above.

• Before any update task, please ensure you have a recent backup that can easily be restored.

For further information and support, please contact NCSA by email at rwcsirt@ncsa.gov.rw or call us on 9009.

References
https://fortiguard.fortinet.com/psirt/FG-IR-23-485
https://www.fortiguard.com/psirt/FG-IR-23-446