Fortinet SSL-VPN Remote Code Execution (CVE-2024-21762 & CVE-2024-47575): Critical Mitigation for Kenyan IT

Active In-The-Wild Exploitation of Perimeter Firewalls

Threat actors are actively scanning Kenyan IP space to exploit vulnerabilities in Fortinet FortiGate appliances. CVE-2024-21762 (CVSS 9.8) and CVE-2024-47575 allow unauthenticated attackers to execute arbitrary code or commands via specially crafted HTTP requests to the SSL-VPN web portal.

Immediate Emergency Remediation Steps

1. Upgrade FortiOS Firmware Immediately: Upgrade to patched releases: FortiOS 7.4.4+, 7.2.8+, or 7.0.14+.
2. Disable SSL-VPN if Immediate Patching is Delayed: If maintenance windows cannot be scheduled immediately, disable the SSL-VPN feature entirely.
3. Migrate to IPsec VPN or Zero Trust Network Access (ZTNA): Transition remote enterprise employees from browser-based SSL-VPN to hardened IPsec tunnels with mandatory Multi-Factor Authentication (MFA).