Actively exploited in the wild
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Fortinet - FortiOS and FortiProxy · Listed in the CISA KEV since 2025-03-18. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-24472
HighCVSS 8.1KEVExploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
An authentication bypass vulnerability in FortiOS and FortiProxy allows a remote unauthenticated attacker, with prior knowledge of upstream and downstream device serial numbers, to gain super-admin privileges on the downstream device if Security Fabric is enabled. The attack is carried out via crafted CSF proxy requests.
Risk Assessment
The risk involves complete compromise of the downstream device within the Security Fabric, potentially leading to data confidentiality, integrity, and availability breaches, as well as lateral movement within the infrastructure.
Recommendation
Immediately upgrade FortiOS to version 7.0.17 or later and FortiProxy to version 7.2.13/7.0.20 or later. If upgrading is not possible, consider temporarily disabling the Security Fabric feature.
Original NVD description (English source)
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.