CVE-2025-24472: Fortinet FortiOS authentication bypass via CSF proxy requests, exploited
The short version: FortiOS and FortiProxy have an authentication-bypass flaw (CVE-2025-24472) that can grant super-admin via crafted Security Fabric (CSF) proxy requests. It's in CISA's KEV catalog and was used alongside CVE-2024-55591 in ransomware intrusions. Exploitation takes a bit more setup than its sibling, but the outcome is the same — patch and verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — real, exploited, but higher attack complexity than its sibling (see below) |
| CVSS v3.1 (NVD/Fortinet CNA) | 8.1 — High · AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~3% · 86.25th percentile (2026-07-17) |
| In CISA KEV? | Yes — added 2025-03-18; remediation was due 2025-04-08 |
| Known exploited? | Yes — used in ransomware activity (Mora_001), chained with CVE-2024-55591 |
| Vulnerability type | CWE-288 authentication bypass via an alternate path → super-admin privileges |
| Requires authenticated session? | No — but exploitation requires knowledge of a device serial number (reflected in AC:H) |
| Affected | FortiOS 7.0.0–7.0.16; FortiProxy 7.0.0–7.0.19, 7.2.0–7.2.12 (Security Fabric enabled) |
| Fixed in | FortiOS 7.0.17 · FortiProxy 7.0.20 · 7.2.13 and later |
What you need to know
CVE-2025-24472 is a companion to CVE-2024-55591: another authentication bypass in FortiOS/FortiProxy, reached this time through crafted Security Fabric (CSF) proxy requests, and again capable of yielding super-admin.
- How they find it — internet-wide scanning surfaces exposed FortiGate management interfaces.
- How they use it — a crafted CSF proxy request bypasses authentication; in observed activity, attackers used it together with CVE-2024-55591 to create rogue admin accounts.
- What it leads to — administrative control of the firewall, and from there the internal network it fronts.
The one practical difference from its sibling is complexity: NVD/Fortinet rate it 8.1 with AC:H, reflecting that exploitation depends on knowing an upstream/downstream device serial number — not a trivial prerequisite, but clearly not a real barrier given it's already been exploited.
How serious we see it
Critical — exploited in the wild, with a genuine (if surmountable) prerequisite.
We land this at High rather than Critical because of the attack-complexity requirement baked into the 8.1: it isn't the point-and-click bypass its sibling is. But it's in KEV, it's been used by ransomware operators alongside CVE-2024-55591, and the payoff is super-admin — so it's still firmly a patch-now item. The bounded, reassuring part: it affects specific FortiOS 7.0.x and FortiProxy builds with Security Fabric enabled, and the same update that fixes CVE-2024-55591 fixes this.
Recommendations
Straight from Fortinet's advisory (FG-IR-24-535) and CISA:
- Patch now. Upgrade to FortiOS 7.0.17 / FortiProxy 7.0.20 / 7.2.13 or later — the same fix that closes CVE-2024-55591.
- Hunt for rogue admins. Review admin accounts and config changes for unexpected additions during the exposure window.
- If you find indicators, respond fully. Remove rogue accounts and rotate credentials, keys, and certificates.
- Harden exposure. Get the administrative interface off the public internet and restrict Security Fabric to trusted peers.
- Confirm your exposure first. Verify whether you run an affected build with Security Fabric enabled and management exposed.
How BreachRisk sees it
BreachRisk discovers internet-facing FortiGate interfaces from little more than your domain, fingerprints the FortiOS/FortiProxy version, and flags exposure tied to KEV-listed, actively exploited flaws like this one — surfaced at the top of your results because it's in KEV. Where authorized, it goes beyond detection and safely performs a bounded, non-disruptive check against the affected endpoint to confirm the bypass responds, rather than flagging a maybe.
Because this one usually travels with CVE-2024-55591, the outside-in view is doubly useful: the same exposed appliance surfaces both, ranked by real-world use, so nothing in the pair gets lost.