CVE-2024-40591

score

<0.1

cvss

8.8

epss

0.6%

published

2025-02-11

kev added

—

first seen

2026-10-21

Fortinet FortiOS 7.6.0, 7.4.0-7.4.4, 7.2.0-7.2.9, and before 7.0.15 contain an incorrect privilege assignment caused by CWE-266, letting authenticated admins with Security Fabric permission escalate privileges to super-admin by connecting to a malicious upstream FortiGate, exploit requires connection to malicious upstream device.