Recent scans have indicated that approximately 150,000 devices running Fortinet’s FortiOS and FortiProxy are at risk due to a critical vulnerability that allows for remote code execution (RCE) without authentication. Fortinet’s FortiOS powers a wide range of security devices within the Fortinet Security Fabric, offering features like DoS attack protection, IPS, firewall, and VPN services, while FortiProxy provides secure web proxy capabilities with additional protections against various cyber threats. The flaw, tracked as CVE-2024-21762, is an out-of-bounds write bug in FortiOS and FortiProxy. The vulnerability, with a high CVSS score of 9.8/10, can be exploited remotely via maliciously crafted HTTP requests. While exact details on the threat actors and their operations remain scarce, the situation underscores the need for administrators to either apply mitigations or upgrade affected systems promptly. This vulnerability has been added to the US Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog, as it has been actively exploited by attackers. Despite Fortinet’s efforts to patch the issue, The Shadowserver Foundation’s findings indicate a substantial number of devices remain vulnerable, particularly in the United States, India, Brazil, and Canada. CTIX analysts recommend that all administrators responsible for the vulnerable devices ensure that their Fortinet infrastructure is up-to-date, and capable of defending against exploitation.