The vulnerability arises from missing authentication for a critical function in Fortinet FortiOS. An attacker can trigger unauthorized code or command execution by sending specially crafted network packets. This flaw is a classic authentication bypass (CWE‑306) that permits remote code execution, potentially compromising confidentiality, integrity, and availability of the affected device.

Affected products are Fortinet FortiOS firmware versions 6.2.9 through 6.2.17, all 6.4 releases, 7.0.0 through 7.0.17, 7.2.0 through 7.2.11, 7.4.0 through 7.4.8, and 7.6.0 through 7.6.3. The issue exists across multiple major FortiOS branches, impacting routers, firewalls, and other network appliances that run these firmware releases.

The CVSS score of 6.2 indicates medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, so there is no evidence of widespread active exploitation. Nonetheless, the required condition is simply connectivity to the device over the network and the ability to craft packets, making exploitation feasible for an attacker with network access. The lack of authentication makes the attack surface broad across all exposed network interfaces.