CVE-2021-32589: Fortinet Fortianalyzer

Critical severity, CVSS 9.8. EPSS: 8.9% chance of exploitation in the next 30 days.

A Use After Free (CWE-416) vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 and below, version 5.6.10 and below, version 5.4.7 and below, version 5.2.10 and below, version 5.0.12 and below and FortiAnalyzer version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 and below, version 5.6.10 and below, version 5.4.7 and below, version 5.3.11, version 5.2.10 to 5.2.4 fgfmsd daemon may allow a remote, non-authenticated attacker to execute unauthorized code as root via sending a specifically crafted request to the fgfm port of the targeted device.

Affected products

• Fortinet Fortianalyzer: from 5.2.4, before 5.6.11 (fixed in 5.6.11); from 6.0.0, before 6.0.11 (fixed in 6.0.11); from 6.2.0, before 6.2.8 (fixed in 6.2.8); from 6.4.0, before 6.4.6 (fixed in 6.4.6); version 7.0.0 only
• Fortinet FortiManager: from 5.0.0, before 5.6.11 (fixed in 5.6.11); from 6.0.0, before 6.0.11 (fixed in 6.0.11); from 6.2.0, before 6.2.8 (fixed in 6.2.8); from 6.4.0, before 6.4.6 (fixed in 6.4.6); version 7.0.0 only
• Fortinet Fortiportal: from 4.0.0, before 5.3.7 (fixed in 5.3.7); from 6.0.0, before 6.0.6 (fixed in 6.0.6)

Published 2024-12-19. Last modified 2026-06-17.