CVE-2025-24472: high-severity vulnerability in Fortinet FortiOS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
An attacker who knows the serial numbers of network devices can bypass authentication in FortiOS and FortiProxy when Security Fabric is enabled, gaining full administrative access without logging in.
CWE-288 authentication bypass in FortiOS 7.0.0–7.0.16 and FortiProxy 7.2.0–7.2.12, 7.0.0–7.0.19 allows unauthenticated remote attackers to escalate to super-admin via crafted CSF proxy requests when Security Fabric is enabled; requires prior knowledge of upstream and downstream device serial numbers.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.