FortiGate SSL-VPN Exploit Kit
Recovered in the wild. Per-SKU clients for CVE-2024-21762 and CVE-2023-27997, plus the orchestrator and config-stealer that sat on top. Research archive. Not a new bug.
- Name
- FortiGate SSL-VPN Exploit Kit
- Repo
- https://github.com/abraxas/Fortigate-SSL-VPN-Exploit-Kit
- Language
- Python
- Related
- The SSL-VPN pot of gold
- Released
- 2026-08-31
- Tags
- fortinet, ssl-vpn, n-day, python
I found this kit in the wild and released it as found. I did not write the files. Two public n-days - CVE-2024-21762 and CVE-2023-27997 - restamped across 50+ FortiGate SKUs. The gold is the offset matrix, not a new primitive.
exp/ is the per-image clients. poc.py fingerprints a portal and picks the matching file. s.js and shellcode/ are the missing second stage: steal FortiOS config from /data/config/*.gz.
The long-form map is The SSL-VPN pot of gold. Appendix is the file table. The CVEs were patched before this tree went up. Research and detection only. Do not run it against anything you do not own.