The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding a critical authentication bypass vulnerability in Fortinet’s FortiOS and FortiProxy, which is being actively exploited in ransomware attacks.
The vulnerability tracked as CVE-2025-24472, is a high-severity flaw (CVSS 8.1) that allows remote attackers to gain super-admin privileges through crafted CSF proxy requests, bypassing authentication without user interaction.
Affected versions include:
- FortiOS 7.0.0 – 7.0.16
- FortiProxy 7.0.0 – 7.0.19 & 7.2.0 – 7.2.12
Exploitation of this flaw could enable attackers to:
- Create rogue admin accounts
- Modify firewall policies
- Access SSL VPNs to infiltrate internal networks
Mitigation and Response
Fortinet has released patches in FortiOS 7.0.17+ and FortiProxy 7.0.20/7.2.13+ to address the vulnerability. Organizations should apply updates immediately or, if unable, implement temporary mitigations such as:
- Disabling HTTP/HTTPS administrative access
- Enforcing IP-based restrictions
- Monitoring logs for unusual admin activity
CISA urges organizations to prioritize remediation of this vulnerability, as it has been added to its Known Exploited Vulnerabilities (KEV) catalog, a key resource for security teams managing external attack risks.
Comments