CVE-2024-21760 Code injection in FortiSOAR
An authenticated attacker can execute arbitrary code on the host via a playbook code snippet in FortiSOAR.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-21760?
CVE-2024-21760 is a high-severity code injection vulnerability in Fortinet FortiSOAR, published on 18 Mar 2025. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
An improper control of generation of code ('Code Injection') vulnerability [CWE-94] in FortiSOAR Connector FortiSOAR 7.4 all versions, 7.3 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an authenticated attacker to execute arbitrary code on the host via a playbook code snippet.
Weakness: CWE-94
Which versions are affected by CVE-2024-21760?
It affects 1 product.
Products include Fortinet Fortisoar.
How do I fix CVE-2024-21760?
No fix has been published for CVE-2024-21760 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-21760 being exploited?
There is no known exploitation of CVE-2024-21760 in the wild and no public exploit code.
Other vulnerabilities in Fortinet FortiSOAR
Sources
Also known as GHSA-fxh3-9v44-3m3r.