CVE-2023-44250

An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 throu…

Severity: High8.8CVSS 3.1, High
EPSS: 0.90%
Published: 10 Jan 2024
Updated: 17 Jun 2026

Description

Title, description and vendor guidance are quoted from the source records.

An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests.

Weakness: CWE-269

Known exploited

Not listed in CISA KEV as of the last check.

Exploit prediction

0.90% probability of exploitation in the next 30 days (percentile 58%).

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the source states, per branch

Versions matched by Patcharo

Fortinet FortiOSSource: Fortinet (CVE record)

Branch	Affected	Fixed in
7.4	7.4.0 – 7.4.1	Fixed after 7.4.1
7.2	Exact releases: 7.2.5

Versions not listed are stated unaffected by the vendor.

Fortinet FortiProxySource: Fortinet (CVE record)

Branch	Affected	Fixed in
7.4	7.4.0 – 7.4.1	Fixed after 7.4.1

Versions not listed are stated unaffected by the vendor.

Workaround / Vendor remediation

Vendor remediation · FortiOS

Please upgrade to FortiOS version 7.4.2 or above Please upgrade to FortiOS version 7.2.6 or above Please upgrade to FortiProxy version 7.4.2 or above

Vendor remediation · FortiProxy

Please upgrade to FortiOS version 7.4.2 or above Please upgrade to FortiOS version 7.2.6 or above Please upgrade to FortiProxy version 7.4.2 or above

References

https://fortiguard.com/psirt/FG-IR-23-315(opens in a new tab)

Provenance

Every fact on this page comes from the sources below. Nothing is written by an AI.

Fortinet (CVE record): Fortinet (CVE record) · 27 Sept 2026, 23:46 UTC · Parser patcharo-cve5/1.1.0
NVD: NVD · 27 Sept 2026, 23:44 UTC · Parser patcharo-nvd/1.0.0
FIRST EPSS: FIRST EPSS · 27 Sept 2026, 23:46 UTC · Parser patcharo-epss/1.0.0

Last verified: 28 Sept 2026, 02:31 UTC