CVE-2025-24472: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

CVE-2025-24472 is an authentication bypass vulnerability affecting Fortinet FortiOS and FortiProxy. A remote attacker can send crafted CSF proxy requests to obtain super-admin privileges without valid credentials.

This is significant for defenders because these products commonly sit at the network perimeter or act as security gateways. Full administrative control lets an attacker reconfigure devices, intercept traffic, or pivot deeper into the environment. The vulnerability has known ransomware use, so rapid assessment and remediation are warranted.

How it works

The weakness is CWE-288 (Authentication Bypass Using an Alternate Path or Channel). FortiOS and FortiProxy do not correctly enforce authentication on certain CSF proxy request paths. An unauthenticated remote attacker can craft requests that take advantage of this alternate path, bypassing normal login controls and elevating directly to super-admin rights.

Exact request structure, required conditions, and any prerequisites are not detailed here; confirm those mechanics and any proof-of-concept details solely against the official Fortinet advisory. No exploit code or additional technical steps should be assumed beyond the CISA description of crafted CSF proxy requests leading to super-admin access.

Am I affected? How to find it in your systems

FortiOS is the operating system on Fortinet FortiGate firewalls and related appliances; FortiProxy is Fortinet’s secure web proxy product. Both typically run as edge security devices, VPN gateways, or internal segmentation points in enterprise and service-provider networks.

• Inventory every FortiGate, FortiOS-based appliance, and FortiProxy instance, including virtual and cloud-hosted deployments.
• Record the exact firmware or software version running on each device and compare it to the affected version list published in the Fortinet advisory for CVE-2025-24472. Do not rely on version ranges stated elsewhere.
• Identify whether CSF (Fortinet Security Fabric) proxy features are enabled; the vulnerability is exercised via crafted CSF proxy requests.
• Search management and system logs for unexpected super-admin sessions, authentication successes without corresponding login events, or anomalous CSF-related traffic originating from untrusted sources.
• If the devices are managed centrally, use FortiManager or equivalent inventory tools to accelerate discovery and version reporting.

How to remediate

Patch first. Apply the vendor updates for FortiOS and FortiProxy exactly as specified in the Fortinet security advisory for CVE-2025-24472. Confirm the precise fixed versions, upgrade paths, and any required reboot or configuration steps against that advisory; do not assume version numbers from secondary sources.

CISA’s required action is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for any cloud-hosted instances, or discontinue use of the product if mitigations are unavailable.

• After upgrading, verify the new version is active and re-check that CSF proxy authentication now enforces properly.
• Restrict administrative access to management interfaces using IP allow-lists and strong authentication controls supported by the platform.
• Disable any unused CSF or proxy features that are not required for operations.
• Review and rotate any administrative credentials that may have been exposed during the vulnerable period.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls focused on the authentication-bypass class and the CSF proxy attack surface.

• Segment affected devices so that CSF proxy ports and management interfaces are unreachable from the internet or untrusted networks.
• If a web application firewall or IPS is in front of the devices, enable any available virtual-patching signatures that target crafted CSF proxy requests; confirm signature coverage with the WAF vendor.
• Temporarily disable CSF proxy functionality if business operations allow it.
• Enforce strict network allow-lists for all administrative and fabric communication paths.
• Heighten monitoring and alerting for anomalous administrative logins, privilege changes, and unexpected configuration modifications on the devices.

If your data may have been exposed

Actively exploited authentication-bypass vulnerabilities, especially those with known ransomware use, frequently lead to full device compromise, credential theft, and subsequent data encryption or exfiltration. Treat any unpatched, internet-reachable instance as potentially compromised: isolate it, preserve logs, hunt for persistence, and rotate all related credentials and certificates.

As an additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether associated credentials or personal information have already appeared in public dumps.