---
id: CVE-2024-35276
title: >-
  A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.4.0
  through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0.0 through
  7.0.12, FortiAnalyzer 6.4.0 through 6.4.14, FortiAnalyzer Cloud 7.4.1 through
  7.4.3…
summary: >-
  A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.4.0
  through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0.0 through
  7.0.12, FortiAnalyzer 6.4.0 through 6.4.14, FortiAnalyzer Cloud 7.4.1 through
  7.4.3…
severity: medium
cvss: 5.6
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-121
  - CWE-787
vendor: fortinet
product: fortianalyzer
affected:
  - 'fortianalyzer >= 6.4.0, < 6.4.15'
  - 'fortianalyzer >= 7.0.0, < 7.0.13'
  - 'fortianalyzer >= 7.2.0, < 7.2.6'
  - 'fortianalyzer >= 7.4.0, < 7.4.4'
  - 'fortianalyzer_cloud >= 6.4.1, < 7.0.12'
  - 'fortianalyzer_cloud >= 7.2.1, < 7.2.6'
  - 'fortianalyzer_cloud >= 7.4.1, < 7.4.4'
  - 'fortimanager >= 6.4.0, < 6.4.15'
  - 'fortimanager >= 7.0.0, < 7.0.13'
  - 'fortimanager >= 7.2.0, < 7.2.6'
  - 'fortimanager >= 7.4.0, < 7.4.4'
  - 'fortimanager_cloud >= 6.4.1, < 7.0.12'
  - 'fortimanager_cloud >= 7.2.1, < 7.2.6'
  - 'fortimanager_cloud >= 7.4.1, < 7.4.4'
patched:
  - fortianalyzer 7.4.4
  - fortianalyzer_cloud 7.4.4
  - fortimanager 7.4.4
  - fortimanager_cloud 7.4.4
published: '2025-01-14'
updated: '2026-07-08'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-35276'
references:
  - url: 'https://fortiguard.fortinet.com/psirt/FG-IR-24-165'
    label: psirt@fortinet.com
tags:
  - nvd
epss: 0.0042
epssPercentile: 0.33646
ingestedAt: '2026-07-08T14:51:15.601Z'
---

## Overview

A stack-based buffer overflow vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.3, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0.0 through 7.0.12, FortiAnalyzer 6.4.0 through 6.4.14, FortiAnalyzer Cloud 7.4.1 through 7.4.3, FortiAnalyzer Cloud 7.2.1 through 7.2.5, FortiAnalyzer Cloud 7.0.1 through 7.0.11, FortiAnalyzer Cloud 6.4 all versions, FortiManager 7.4.0 through 7.4.3, FortiManager 7.2.0 through 7.2.5, FortiManager 7.0.0 through 7.0.12, FortiManager 6.4.0 through 6.4.14, FortiManager Cloud 7.4.1 through 7.4.3, FortiManager Cloud 7.2.1 through 7.2.5, FortiManager Cloud 7.0.1 through 7.0.11, FortiManager Cloud 6.4 all versions allows attacker to execute unauthorized code or commands via specially crafted packets.

## Affected

- `fortianalyzer >= 6.4.0, < 6.4.15`
- `fortianalyzer >= 7.0.0, < 7.0.13`
- `fortianalyzer >= 7.2.0, < 7.2.6`
- `fortianalyzer >= 7.4.0, < 7.4.4`
- `fortianalyzer_cloud >= 6.4.1, < 7.0.12`
- `fortianalyzer_cloud >= 7.2.1, < 7.2.6`
- `fortianalyzer_cloud >= 7.4.1, < 7.4.4`
- `fortimanager >= 6.4.0, < 6.4.15`
- `fortimanager >= 7.0.0, < 7.0.13`
- `fortimanager >= 7.2.0, < 7.2.6`
- `fortimanager >= 7.4.0, < 7.4.4`
- `fortimanager_cloud >= 6.4.1, < 7.0.12`
- `fortimanager_cloud >= 7.2.1, < 7.2.6`
- `fortimanager_cloud >= 7.4.1, < 7.4.4`

## Remediation

Upgrade past the affected range:

- `fortianalyzer 7.4.4`
- `fortianalyzer_cloud 7.4.4`
- `fortimanager 7.4.4`
- `fortimanager_cloud 7.4.4`