This vulnerability is a stack-based buffer overflow in Fortinet FortiAnalyzer and FortiManager products (including cloud versions) that enables remote attackers to execute unauthorized code or commands via specially crafted packets. The affected versions include FortiAnalyzer 7.4.0 through 7.4.3, 7.2.0 through 7.2.5, 7.0.0 through 7.0.12, 6.4.0 through 6.4.14, and corresponding FortiAnalyzer Cloud and FortiManager versions. The vulnerability has been assigned CVE-2024-35276 and has a CVSS v3.1 base score of 5.0 (medium severity). Fortinet has released official fixes for this vulnerability.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute arbitrary code or commands on affected FortiAnalyzer or FortiManager systems, potentially leading to partial confidentiality, integrity, and availability impacts. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and partial impact on confidentiality, integrity, and availability.

Fortinet has released official patches to fix this vulnerability. Users should apply the provided updates to affected FortiAnalyzer and FortiManager versions as soon as possible to mitigate the risk. Since this is not a cloud service vulnerability, remediation requires customer action to update the affected software. No additional mitigation steps are indicated beyond applying the official fix.