CVE-2025-24472
Published 2025-02-11 · Updated 2026-08-05 · Source psirt@fortinet.com
Summary
CVE-2025-24472 is a high-severity (CVSS 8.1) vulnerability in Fortinet FortiOS and FortiProxy. CISA added it to the Known Exploited Vulnerabilities catalog on March 18, 2025, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 8, 2025. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Fortinet has 32 vulnerabilities in the KEV catalog, 14 of them linked to ransomware.
All 32 known-exploited Fortinet vulnerabilities →Description
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Fortinet — FortiOS and FortiProxy
Name: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Date added: 2025-03-18 · Due: 2025-04-08
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.