CISA Warns of Fortinet FortiOS Authentication Bypass Vulnerability Exploited in Wild
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical security alert highlighting a significant vulnerability in Fortinet\u2019s FortiOS and FortiProxy systems, which threat actors are actively exploiting.<\/p>\n
The authentication bypass vulnerability, tracked as CVE-2025-24472<\/a>, has been added to CISA\u2019s Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation in ransomware campaigns.<\/p>\n The high-severity vulnerability, which carries a CVSS score of 8.1, allows remote attackers to gain super-admin privileges through crafted CSF proxy requests without requiring user interaction.\u00a0<\/p>\n \u201cAn Authentication Bypass Using an Alternate Path or Channel vulnerability affecting FortiOS and FortiProxy may allow a remote attacker to gain super-admin privileges via crafted CSF proxy requests,\u201d states the Fortinet advisory<\/a>.\u00a0<\/p>\n The vulnerability impacts explicitly FortiOS versions 7.0.0 through 7.0.16, FortiProxy 7.0.0 through 7.0.19, and FortiProxy 7.2.0 through 7.2.12.<\/p>\n Security experts warn that successful exploitation could provide attackers full administrative access to affected systems, including creating rogue admin accounts, modifying firewall policies, and accessing SSL VPNs to penetrate internal networks.\u00a0<\/p>\n This level of access makes the vulnerability particularly dangerous in the context of ransomware operations.<\/p>\nFortinet FortiOS Authentication Bypass Vulnerability\u00a0<\/strong><\/h2>\n