What is CVE-2024-40591?

CVE-2024-40591 is a high-severity vulnerability in Fortinet Fortios, classified under Incorrect Privilege Assignment. CVSS score: 8.8/10. Published 2025-02-11.

How severe is CVE-2024-40591?

High severity. CVSS v3 base score is 8.8 out of 10.

Privilege escalation in Fortinet Fortios

CVE-2024-40591

An incorrect privilege assignment vulnerability [CWE-266] in Fortinet FortiOS version 7.6.0, 7.4.0 through 7.4.4, 7.2.0 through 7.2.9 and before 7.0.15 allows an authenticated admin whose access profile has the Security Fabric permission to escalate their privileges to super-admin by connecting the targetted FortiGate to a malicious upstream FortiGate they control.

EPSS: 0.006 (45.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Fortinet Fortios — versions 7.6.0, 7.4.0, 7.2.0

Weakness classification (CWE)

CWE-266 — Incorrect Privilege Assignment

References

psirt@fortinet.com (Vendor Advisory)

Frequently asked questions

What is CVE-2024-40591?: CVE-2024-40591 is a high-severity vulnerability in Fortinet Fortios, classified under Incorrect Privilege Assignment. CVSS score: 8.8/10. Published 2025-02-11.
How severe is CVE-2024-40591?: High severity. CVSS v3 base score is 8.8 out of 10.