CVE-2025-24472 is a high-severity authentication bypass vulnerability in Fortinet FortiOS and FortiProxy that can allow a remote unauthenticated attacker to obtain super-admin privileges on a downstream device through specially crafted CSF proxy requests.
That description alone makes the vulnerability serious. But it also leaves out the most important details security teams need in order to assess real exposure.
The current Fortinet-supplied CVE description specifies that exploitation depends on the Security Fabric being enabled and requires the attacker to have prior knowledge of the serial numbers of the upstream and downstream devices. The affected ranges are FortiOS 7.0.0 through 7.0.16, FortiProxy 7.0.0 through 7.0.19, and FortiProxy 7.2.0 through 7.2.12. Fortinet assigns CVE-2025-24472 a CVSS 3.1 score of 8.1 High, with high attack complexity but no authentication or user interaction required once the necessary conditions are satisfied. (NVD)
Those prerequisites are important because they make CVE-2025-24472 more specific than the simplified description repeated in many early vulnerability reports. It should not be understood as a generic unauthenticated login bypass that automatically works against every vulnerable FortiGate exposed to the Internet.
It should also not be underestimated.
CISA added CVE-2025-24472 to its Known Exploited Vulnerabilities Catalog on March 18, 2025, gave U.S. federal civilian agencies a remediation deadline of April 8, 2025, and currently marks the vulnerability as known to be used in ransomware campaigns. (CISA)
The operational risk therefore sits at the intersection of two realities: exploitation has meaningful environmental prerequisites, but successful exploitation crosses one of the most important trust boundaries in an enterprise network—the administrative control plane of the firewall itself.
CVE-2025-24472 at a Glance
| Atributo | CVE-2025-24472 |
|---|---|
| CVE | CVE-2025-24472 |
| Vendor | Fortinet |
| Products | FortiOS and FortiProxy |
| Tipo de vulnerabilidad | Authentication Bypass Using an Alternate Path or Channel |
| CWE | CWE-288 |
| Fortinet CVSS 3.1 | 8.1 High |
| Vector de ataque | Red |
| Attack complexity | Alta |
| Privileges required | Ninguno |
| Interacción con el usuario | Ninguno |
| Primary attack path | Crafted CSF proxy requests |
| Important prerequisite | Security Fabric enabled |
| Additional prerequisite | Prior knowledge of upstream and downstream device serial numbers |
| FortiOS affected | 7.0.0 through 7.0.16 |
| FortiProxy affected | 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 |
| FortiOS fixed branch | Upgrade to 7.0.17 or later |
| FortiProxy fixed branches | Upgrade to 7.0.20 or later, or 7.2.13 or later |
| CISA KEV | Sí |
| Known ransomware use | Sí |
These values reflect the current Fortinet/NVD record and CISA KEV data rather than some of the earlier reporting around the vulnerability. (NVD)
What Is CVE-2025-24472?
CVE-2025-24472 is classified as CWE-288: Authentication Bypass Using an Alternate Path or Channel.
That classification is useful because it describes the security failure more accurately than simply saying that “authentication is broken.”
In a normal administrative workflow, a security appliance should authenticate an administrator before granting access to privileged management functionality. But complex infrastructure products rarely expose only one logical path into privileged operations.
A FortiGate can participate in a larger Security Fabric architecture in which Fortinet devices exchange information and coordinate operations. Those trusted relationships require internal mechanisms that are different from an administrator entering a username and password into the ordinary GUI.
CVE-2025-24472 concerns one of those alternative paths.
Fortinet states that specially crafted CSF proxy requests can be used to bypass the expected authentication boundary and obtain super-admin privileges on a downstream device when the required Security Fabric conditions are present. (NVD)
Conceptually, the risk looks like this:
This is precisely why CWE-288 matters.
The attacker is not necessarily defeating a password algorithm, stealing an MFA token, or cracking an administrator credential. Instead, the attacker reaches functionality through a path whose authentication assumptions differ from those of the ordinary administrative login flow.
For perimeter infrastructure, that distinction is extremely important.
Why the Current CVE Description Matters
One of the easiest mistakes when researching CVE-2025-24472 is relying on an article written immediately after disclosure and treating it as the final technical truth.
The CVE record changed.
The original February 2025 description stated broadly that affected FortiOS and FortiProxy versions could allow a remote attacker to obtain super-admin privileges through crafted CSF proxy requests. Fortinet later updated the description to specify that the attacker is unauthenticated, must know the serial numbers of the upstream and downstream devices, and can attack the downstream device when Security Fabric is enabled. (NVD)
That update substantially improves exposure assessment.
A useful way to think about the present vulnerability condition is:
Affected software version
+
Security Fabric enabled
+
Required device relationship
+
Knowledge of relevant serial numbers
+
Reachable attack path
=
Potential CVE-2025-24472 exposure
A vulnerability scanner that observes FortiOS 7.0.13, for example, has identified an important piece of evidence. It has not necessarily proven that CVE-2025-24472 can be exploited in that exact deployment.
Conversely, a security team should not dismiss the finding merely because exploiting it is more complex than initially believed. CISA’s KEV designation demonstrates that this is not a theoretical weakness that defenders can safely leave unresolved. (CISA)
CVE-2025-24472 Is High Severity, Not Currently a CVSS 9.8 Critical Vulnerability
Another recurring problem in CVE-2025-24472 coverage is severity inflation.
Fortinet’s current CNA assessment gives CVE-2025-24472 a CVSS 3.1 base score of 8.1 High, using the vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
That means the vulnerability is network reachable, requires no existing privileges and no user interaction, and can have high confidentiality, integrity, and availability impact. However, Fortinet assigns High attack complexity, which reduces the base score. (NVD)
The distinction matters.
CVE-2025-24472 should not be promoted to “Critical 9.8” simply because another scoring interpretation appeared in early databases or secondary coverage. NVD’s change history shows that an earlier NIST assessment using low attack complexity was subsequently removed, leaving Fortinet’s 8.1 CNA score as the relevant published CVSS 3.1 rating displayed on the current record. (NVD)
At the same time, CVSS alone is a poor remediation queue for this case.
An 8.1 vulnerability with proven exploitation, ransomware use, and the ability to obtain super-admin control over a network security appliance can deserve greater operational urgency than a theoretical 9.8 vulnerability hidden inside an unreachable application component.
This is precisely where CISA KEV provides additional context that a base score cannot.
CVE-2025-24472 vs CVE-2024-55591
CVE-2025-24472 is closely associated with another Fortinet authentication bypass, CVE-2024-55591.
The two vulnerabilities appear in the same Fortinet advisory, FG-IR-24-535, but they should not be treated as interchangeable vulnerability identifiers.
CVE-2024-55591 concerns an authentication bypass through crafted requests to the Node.js WebSocket module. CVE-2025-24472 concerns the CSF proxy request path associated with Security Fabric. Both can lead to super-admin access, but the entry paths and exposure conditions differ. Fortinet’s advisory was originally published in January 2025 and was later updated on February 11 to add CVE-2025-24472. (fortiguard.com)
This relationship explains some of the confusion around disclosure and exploitation.
Security researchers initially investigated attacks associated with the broader Fortinet authentication-bypass problem. As incident-response evidence accumulated, researchers were able to distinguish activity involving different paths into vulnerable FortiGate systems.
Forescout Research–Vedere Labs later reported that one victim involved in its investigation contacted Fortinet, and Fortinet subsequently updated its advisory to include CVE-2025-24472. Forescout specifically described cases in which the threat actor used a fortigate-firewall account while exploiting the path attributed to CVE-2025-24472 instead of CVE-2024-55591. (Forescout)
This history is one reason defenders should investigate both CVEs rather than searching logs for a single narrowly defined exploit signature.
Why FortiOS Authentication Bypass Is So Dangerous
Authentication bypass on an ordinary web application can be devastating. Authentication bypass on the administrative plane of an enterprise firewall is potentially much worse.
The firewall often has visibility into network topology, security policies, VPN configuration, internal address ranges, routing information, trusted relationships, and remote-access infrastructure.
A super-admin compromise therefore changes the security meaning of the device.
The FortiGate is no longer merely failing to block an attacker. It may become an attacker-controlled observation point and persistence mechanism at the boundary of the network.
Forescout’s investigation illustrates this progression. After gaining access to compromised FortiGate systems, the observed actor created local administrator accounts, backed up firewall configurations, modified configuration data, established additional VPN access, created scheduled automation for persistence, and used information gathered from the appliance to support deeper network discovery. (Forescout)
The practical attack chain can therefore become:
FortiGate compromise
|
v
super_admin access
|
+--> create administrator
|
+--> export firewall configuration
|
+--> inspect routes and network topology
|
+--> inspect VPN configuration
|
+--> create VPN users
|
+--> create scheduled persistence
|
+--> propagate changes in HA environments
|
v
Internal network access
|
v
Lateral movement
|
v
Data theft / ransomware
That is why defenders should think of CVE-2025-24472 as an identity and control-plane compromise, not just another firewall software bug.
CVE-2025-24472 and SuperBlack Ransomware
The most important threat-intelligence development around CVE-2025-24472 came from Forescout Research–Vedere Labs in March 2025.
Forescout investigated a series of intrusions occurring between late January and early March and attributed the activity to a threat actor it tracks as Mora_001. Those incidents began with exploitation of Fortinet firewall vulnerabilities and ultimately led to deployment of a newly identified ransomware strain called SuperBlack. (Forescout)
Forescout associated the intrusions with exploitation of CVE-2024-55591 and CVE-2025-24472.
The actor also demonstrated behavioral links to the wider LockBit ecosystem. Forescout reported that the ransomware operation used a leaked LockBit builder and that the ransom note contained a Tox identifier associated with LockBit, although the researchers continued to track Mora_001 as a distinct operational entity rather than simply declaring it to be LockBit. (Forescout)
That attribution nuance matters.
“Linked to LockBit” is supportable.
“CVE-2025-24472 was exploited directly by LockBit itself” is a stronger claim and should not be made without evidence.
What Attackers Did After FortiGate Compromise
The most valuable part of the Forescout research is not the ransomware name. It is the post-exploitation behavior.
Successful exploitation was only the first step.
Forescout observed attackers creating local administrative identities including names such as forticloud-tech, fortigate-firewall, and a misspelled adnimistrator. In some incidents, newly created administrator accounts were then used to create additional accounts, complicating remediation. (Forescout)
Attackers also downloaded firewall configuration files.
For incident responders, this matters enormously because a configuration backup can reveal far more than firewall rules. Depending on the environment and configuration, it can provide a map of routing, policies, VPN relationships, interfaces, addressing, and other information useful for planning the next stage of an intrusion. Forescout explicitly observed configuration backup and configuration-change activity in the incidents it investigated. (Forescout)
Persistence went further.
The threat actor created automation actions and scheduled triggers designed to recreate a privileged forticloud-sync administrator account. That means deleting one suspicious account without reviewing automation configuration could leave the underlying persistence mechanism intact. (Forescout)
In HA deployments, Forescout also observed the actor abusing synchronization behavior so that compromised configuration elements could propagate to additional firewalls in the cluster. (Forescout)
This is a critical incident-response lesson: after a perimeter security appliance has been compromised, remediation cannot be reduced to “change the admin password.”
CISA KEV Changes the Prioritization Decision
On March 18, 2025, CISA added CVE-2025-24472 to the Known Exploited Vulnerabilities Catalog.
The catalog entry identifies the flaw as Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability, states that crafted CSF proxy requests can provide super-admin privileges, and identifies the vulnerability as known to be used in ransomware campaigns. The remediation deadline for U.S. federal civilian agencies was April 8, 2025. (CISA)
For private-sector organizations, that deadline is not itself a universal legal requirement. The more important point is prioritization.
KEV inclusion means defenders have evidence that exploitation exists outside a research environment.
For organizations still running an affected FortiOS or FortiProxy build in 2026, the question is therefore not whether someone might eventually write an exploit.
That window has already passed.
CVE-2025-24472 Remains Relevant in 2026
CVE-2025-24472 is also not merely historical because it was disclosed in February 2025.
On August 10, 2026, CISA published a joint #StopRansomware advisory on Gunra ransomware that again referenced CVE-2024-55591 and CVE-2025-24472 in the context of activity involving vulnerable FortiOS firewall devices. (CISA)
The significance is not that the vulnerability suddenly became new again.
It is that edge-device vulnerabilities can remain operationally valuable to ransomware actors long after patches have been available.
Organizations often replace application servers, rebuild cloud workloads, and continuously deploy new application versions. Firewalls and other network appliances can remain in production considerably longer, especially when upgrades require maintenance windows, routing changes, HA planning, or concern about configuration compatibility.
That makes stale edge appliances attractive targets.
Which Versions Are Affected by CVE-2025-24472?
Fortinet identifies FortiOS 7.0.0 through 7.0.16 as affected.
The corresponding fixed version in that branch is FortiOS 7.0.17 or later.
FortiProxy 7.0.0 through 7.0.19 is affected and should be upgraded to 7.0.20 or later.
FortiProxy 7.2.0 through 7.2.12 is affected and should be upgraded to 7.2.13 or later.
The Fortinet advisory data also identifies FortiOS 6.4, 7.2, 7.4, and 7.6 as not affected by this specific vulnerability and identifies FortiProxy 7.4 and 7.6 as unaffected. (CIRCL Vulnerability Lookup)
Security teams should nevertheless follow Fortinet’s supported upgrade path rather than interpret “7.0.17 or above” as permission to jump arbitrarily between major release branches.
In 2026, upgrading only to the first historical build that fixed this CVE may also be inadequate vulnerability management. Fortinet has published additional security fixes since January 2025. Organizations should evaluate the latest supported maintenance release appropriate for their hardware and deployment rather than stopping at the minimum historical CVE boundary.
Why Security Fabric Changes the Exposure Model
The most important configuration question for CVE-2025-24472 is whether Security Fabric is actually enabled.
Security Fabric is designed to allow Fortinet infrastructure components to operate as an integrated security environment. That requires trust and communication between devices.
From an architectural perspective, any such trust relationship creates additional attack surface.
A simplified model looks like this:
Security Fabric
Upstream FortiGate
|
|
trusted coordination
|
v
Downstream FortiGate
|
|
protected networks
CVE-2025-24472 demonstrates a broader security principle: internal trust protocols deserve the same authentication scrutiny as public administrative interfaces.
A product can have a correctly functioning login page, MFA deployment, complex administrator passwords, and tightly governed identity policy while still containing an alternative privileged path whose assumptions create an authentication bypass.
This is precisely what CWE-288 is intended to describe.
Does MFA Stop CVE-2025-24472?
Administrators should not assume MFA alone resolves this vulnerability.
The security issue exists in an alternative authentication path rather than simply in an administrator submitting a password through the ordinary interactive login workflow. Fortinet describes the vulnerability as allowing a remote unauthenticated attacker to gain privileged access through crafted CSF proxy requests when the required conditions are present. (NVD)
MFA remains an important administrative security control.
It can protect legitimate authentication workflows and reduce risk from stolen administrator credentials.
But it is not a substitute for upgrading vulnerable FortiOS or FortiProxy software.
Does Disabling Internet Management Fix CVE-2025-24472?
Restricting management-plane reachability is strongly recommended, but defenders should distinguish attack-surface reduction de software remediation.
Forescout recommends disabling external management access to firewalls whenever possible, alongside patching vulnerable systems. (Forescout)
Removing Internet exposure can dramatically reduce opportunities for exploitation from arbitrary remote systems.
It does not transform vulnerable software into fixed software.
Exposure could still exist from another reachable network segment, through a compromised internal host, through VPN connectivity, or through a different architecture that makes the relevant communication path reachable.
The correct objective is therefore both to patch the vulnerable appliance and to minimize management-plane exposure.
Fortinet’s Workaround: Disable Security Fabric
For organizations that could not immediately update, Fortinet’s published workaround for the CSF-request issue was to disable Security Fabric.
Singapore’s Cyber Security Agency reproduced the vendor mitigation as:
config system csf
set status disable
end
CSA Singapore also confirmed that CVE-2025-24472 had already been addressed by the patches released in January 2025 in connection with the earlier Fortinet advisory. (Cyber Security Agency of Singapore)
This workaround should not be applied blindly.
Security Fabric may be operationally important to a production deployment. Administrators should understand what functionality depends on the feature before disabling it.
Where Security Fabric is unnecessary, however, disabling unused functionality follows a strong security principle: an inactive feature should not remain an unnecessary privileged attack surface.
How to Detect Possible CVE-2025-24472 Exploitation
Detection should focus less on finding a magical string named CVE-2025-24472 and more on identifying what successful super-admin compromise looks like.
The most useful evidence comes from administrative behavior.
Forescout’s observed incidents provide several strong detection opportunities: successful super-admin logins through unusual interfaces, unexpected administrator creation, firewall configuration backups, VPN-user modifications, scheduled automation creation, and unexplained configuration changes. (Forescout)
A defensive hunt should therefore correlate FortiGate system logs around these behaviors.
Por ejemplo:
Admin login successful
+
profile=super_admin
+
unexpected source / interface
should receive high priority.
Likewise:
Add system.admin <unexpected_user>
deserves investigation, especially when the account cannot be linked to a documented administrative change.
Forescout specifically recommends monitoring for new administrator accounts and identified Add system.admin activity as a useful detection opportunity. (Forescout)
Configuration backup activity is another useful signal:
System configuration backed up
Configuration exports are legitimate administrative operations, so they should not automatically generate a breach declaration. But a backup initiated by an unfamiliar administrator, an unexpected source, or immediately after suspicious privileged access should be treated differently from an approved change-window operation. Forescout observed configuration backup as part of the intrusion sequence. (Forescout)
Scheduled automation requires similar scrutiny.
If an attacker has already created a task that recreates a privileged account, deleting the account treats the symptom rather than the persistence mechanism.
Investigators should therefore review system.automation-action, automation triggers, and automation stitches for unauthorized changes. Forescout directly observed this technique in the Mora_001 incidents. (Forescout)
Hunt for Suspicious Administrator Accounts
Administrative inventory should be treated as incident-response evidence rather than static configuration.
Every administrator account should have an owner, business justification, expected authentication mechanism, creation history, and privilege profile.
Unexpected accounts with super_admin privileges require immediate explanation.
Forescout observed suspicious names including forticloud-tech, fortigate-firewally adnimistrator during the SuperBlack-linked incidents. (Forescout)
Those names are useful historical indicators.
They are not universal signatures.
An attacker can trivially choose a different username, so defenders should not construct detection logic that effectively says:
username == forticloud-tech
Instead, detection should ask:
Was a privileged administrator created?
Who created it?
From where?
Was there an approved change?
Did that administrator perform a configuration backup?
Did it create VPN users?
Did it create automation?
What happened immediately before and after?
Behavioral correlation is more durable than a username IOC.
Audit VPN Accounts After FortiGate Compromise
A compromised firewall can provide an attacker with an opportunity to create a second access path.
Forescout observed Mora_001 creating local VPN users with names designed to resemble existing legitimate accounts and adding those users to VPN groups. (Forescout)
That creates an important remediation rule.
If CVE-2025-24472 exploitation is suspected, auditing the administrator table alone is insufficient.
VPN users, VPN groups, authentication infrastructure, remote-access policies, certificates, secrets, and related identity systems should also be reviewed.
Otherwise, an organization can patch the original vulnerability while leaving the attacker with a perfectly functional secondary route into the environment.
Treat Configuration Theft as a Credential and Architecture Exposure Event
A stolen firewall configuration deserves serious incident handling.
The exact contents vary with configuration and product behavior, but firewall configurations can disclose information that substantially accelerates later intrusion activity.
Forescout observed compromised appliances being used to back up their configurations and later used FortiGate information to support network discovery and pivoting. (Forescout)
That means the remediation question should not be:
Did the ransomware binary execute?
A more useful question is:
What trusted information became available once the firewall was controlled?
The answer may require rotating exposed secrets, reviewing VPN credentials, validating certificates and trust relationships, checking firewall policies, examining external integrations, and hunting internal infrastructure that became easier to target once the network architecture was known.
Patching Is Necessary, but It Does Not Erase Prior Compromise
This is perhaps the most important operational distinction in the entire CVE-2025-24472 story.
Patching answers:
Can this vulnerable attack path still be used?
Incident response answers:
Was it already used?
They are not the same question.
If an affected FortiOS device was reachable during the known exploitation period, an upgrade should be followed by compromise assessment.
That assessment should examine administrator creation, administrative login history, Security Fabric configuration, configuration exports, VPN users, automation tasks, HA propagation, firewall policy changes, authentication integrations, and internal systems that were accessed after the suspected compromise.
Forescout’s observed intrusion chain demonstrates why this matters: the actor deliberately created persistent accounts and scheduled mechanisms that could survive simplistic remediation. (Forescout)
A successfully installed firmware update does not automatically remove an attacker-created VPN identity or unauthorized automation task.
Safe CVE-2025-24472 Validation
Security teams should avoid turning production FortiGate appliances into exploit laboratories merely because a public proof of concept exists.
For most organizations, the first objective is not exploitation.
It is exposure determination.
A reliable assessment can establish the exact software release, confirm whether the asset falls inside Fortinet’s affected ranges, determine whether Security Fabric is enabled, document upstream and downstream relationships, map management and fabric reachability, check whether the relevant mitigation is active, review compromise evidence, and verify the state again after remediation.
This distinction is particularly important for CVE-2025-24472 because Fortinet’s updated vulnerability description includes deployment-specific prerequisites that a simple version match does not prove. (NVD)
A scanner result reading:
FortiOS 7.0.13 detected
CVE-2025-24472
is meaningful evidence of vulnerable software.
It is not yet the complete risk statement.
A better result looks more like:
Software: FortiOS 7.0.13
Version state: affected
Security Fabric: enabled
Device role: downstream member
Relevant communication path: reachable
Historical exposure: confirmed
Suspicious admin activity: not observed / observed
Configuration backups: reviewed
Automation persistence: reviewed
Remediation: upgraded
Post-remediation validation: passed
That is much closer to the information a security owner actually needs.
Evidence-Driven Verification With AI Pentesting
CVE-2025-24472 is also a useful example of where AI-assisted penetration testing can be more valuable than simple CVE matching.
The challenge is not asking an agent to “run an exploit.”
The useful problem is reasoning across multiple evidence sources.
For an authorized FortiOS assessment, an AI-assisted workflow can correlate the Fortinet advisory, affected-version boundaries, target fingerprint, Security Fabric configuration, management-plane exposure, administrator logs, automation configuration, VPN identities, and remediation evidence before determining whether a finding is merely possible or actually substantiated.
Penligent’s existing CVE verification approach is built around this distinction between version detection and evidence-backed validation, and its published material emphasizes confirming relevant features, attack-surface reachability, mitigation status, and remediation results instead of treating a scanner’s CVE match as proof of exploitability. (Penligente)
For CVE-2025-24472 specifically, that matters because the current Fortinet description requires configuration and topology context that a conventional banner-only scanner cannot establish by itself. (NVD)
The objective in production should remain controlled validation and evidence collection. Destructive exploitation belongs only in an isolated environment where the tester has explicit authorization and understands the effect on a device that may control live network traffic.
Why Edge Security Appliances Need Different Vulnerability Management
CVE-2025-24472 exposes a broader weakness in traditional vulnerability-management programs.
Organizations often assign vulnerabilities to queues based primarily on CVSS score.
That approach is insufficient for edge appliances.
A firewall, VPN gateway, remote-access system, identity provider, hypervisor management plane, and cloud control plane occupy different positions of trust from an ordinary application server.
Compromise of one of these systems can effectively change the attacker’s position in the network.
For CVE-2025-24472, the initial result is not simply unauthorized access to one webpage.
It is potential super-admin control over a network security appliance.
Forescout’s incident research shows how quickly that privileged position can be converted into persistence, network discovery, configuration theft, VPN access, lateral movement, and ultimately ransomware deployment. (Forescout)
Risk prioritization should account for that blast radius.
The Security Fabric Lesson
Security Fabric is not inherently insecure because CVE-2025-24472 exists.
The lesson is broader.
Any mechanism that creates privileged machine-to-machine trust deserves threat modeling comparable to human administrative authentication.
Modern infrastructure increasingly contains these relationships:
controller -> agent
manager -> appliance
cluster leader -> cluster member
cloud plane -> edge node
orchestrator -> workload
identity provider -> service
security platform -> security sensor
Every arrow is a trust boundary.
If software assumes that requests arriving over an alternative trusted path are already authenticated, the system must establish that trust cryptographically and enforce it consistently.
Otherwise, the alternate path can become the bypass path.
CVE-2025-24472 is a concrete example of why security engineers should ask not only:
How does an administrator authenticate?
but also:
What other mechanisms can cause the system to act with administrator-equivalent authority?
That second question often finds the more interesting bugs.
What Defenders Should Do Now
For an organization discovering a potentially affected FortiOS or FortiProxy device today, the correct response begins with exact inventory and configuration evidence rather than assumptions.
Confirm the installed firmware release against Fortinet’s affected ranges. Determine whether Security Fabric is enabled. Identify the device’s role and related Fortinet infrastructure. Establish which networks can reach administrative and fabric communication paths. Upgrade affected systems using Fortinet’s supported upgrade guidance. If upgrading is temporarily impossible and operationally acceptable, evaluate Fortinet’s Security Fabric disablement workaround. (CIRCL Vulnerability Lookup)
Then investigate the historical period before remediation.
Review privileged logins, administrator creation, configuration backups, VPN identities and group membership, scheduled automation, HA configuration propagation, and configuration modifications. These are not hypothetical post-exploitation ideas; several were observed directly in the Forescout investigations. (Forescout)
Finally, validate the repaired state rather than merely closing a ticket because an upgrade command completed.
The strongest closure evidence demonstrates that the installed version is outside the affected range, the expected security configuration is active, unnecessary management exposure has been removed, unauthorized persistence is absent, and relevant historical logs have been reviewed.
Frequently Asked Questions
What is CVE-2025-24472?
CVE-2025-24472 is an authentication bypass vulnerability affecting Fortinet FortiOS and FortiProxy. Under the conditions described by Fortinet, an unauthenticated remote attacker can use crafted CSF proxy requests to obtain super-admin privileges on a downstream device. (NVD)
How severe is CVE-2025-24472?
Fortinet assigns the vulnerability a CVSS 3.1 score of 8.1 High. The vector is network reachable, requires no privileges and no user interaction, but carries High attack complexity. (NVD)
Is CVE-2025-24472 Critical?
Under Fortinet’s current CVSS assessment, no. It is rated High at 8.1, not Critical. Operationally, however, KEV inclusion, ransomware use, and the super-admin impact justify urgent remediation. (NVD)
Is CVE-2025-24472 actively exploited?
Yes. CISA includes CVE-2025-24472 in its Known Exploited Vulnerabilities Catalog and currently marks it as known to have been used in ransomware campaigns. (CISA)
Was CVE-2025-24472 used by ransomware operators?
Yes. Forescout associated exploitation of CVE-2024-55591 and CVE-2025-24472 with intrusions conducted by Mora_001 that ultimately deployed SuperBlack ransomware. CISA also marks CVE-2025-24472 as known to be used in ransomware campaigns. (Forescout)
What conditions are required for CVE-2025-24472 exploitation?
Fortinet’s current description says Security Fabric must be enabled and the attacker must have prior knowledge of the serial numbers of the upstream and downstream devices. The attack targets the downstream device through crafted CSF proxy requests. (NVD)
Which FortiOS versions are vulnerable?
FortiOS 7.0.0 through 7.0.16 are affected. Fortinet directs customers to upgrade to 7.0.17 or later for this vulnerability. (CIRCL Vulnerability Lookup)
Which FortiProxy versions are vulnerable?
FortiProxy 7.0.0 through 7.0.19 and FortiProxy 7.2.0 through 7.2.12 are affected. The corresponding fixed releases are 7.0.20 or later and 7.2.13 or later. (CIRCL Vulnerability Lookup)
Is FortiOS 7.2 affected by CVE-2025-24472?
Fortinet’s affected-version table identifies FortiOS 7.2 as not affected by this specific CVE. Administrators should still run an appropriate currently supported security release because other FortiOS vulnerabilities may affect that branch. (CIRCL Vulnerability Lookup)
Is disabling Security Fabric a valid workaround?
Yes. Fortinet’s mitigation for the CSF-request issue is to disable Security Fabric when an immediate upgrade is not feasible. Singapore’s Cyber Security Agency reproduces that vendor guidance. (Cyber Security Agency of Singapore)
Is upgrading enough after possible exploitation?
Not necessarily.
Upgrading closes the vulnerable path, but it does not automatically delete attacker-created administrators, VPN users, scheduled automation, or other persistence. Forescout observed each of these types of post-exploitation behavior during related FortiGate intrusions. (Forescout)
How is CVE-2025-24472 different from CVE-2024-55591?
Both are Fortinet authentication bypass vulnerabilities capable of leading to super-admin access. CVE-2024-55591 involves crafted requests to the Node.js WebSocket module, while CVE-2025-24472 concerns crafted CSF proxy requests associated with Security Fabric. (fortiguard.com)
Final Assessment
CVE-2025-24472 deserves attention for a reason deeper than its CVSS score.
It demonstrates what happens when an alternative trusted communication path reaches the administrative boundary of a security appliance.
Fortinet’s current data also gives defenders a much more precise model than early reporting did. The vulnerability affects specific FortiOS and FortiProxy releases, exploitation depends on Security Fabric, and the attacker requires knowledge of upstream and downstream serial numbers. Those facts justify describing the attack as high complexity, not as an unconditional one-request takeover of every vulnerable FortiGate. (NVD)
But those prerequisites do not make the vulnerability academic.
CISA’s KEV catalog confirms exploitation and identifies ransomware use. Forescout reconstructed real intrusions in which Fortinet compromise was followed by administrator creation, configuration theft, persistence, VPN abuse, internal discovery, and SuperBlack ransomware deployment. (CISA)
And as recently as August 10, 2026, CVE-2025-24472 again appeared in CISA ransomware guidance concerning vulnerable FortiOS infrastructure. (CISA)
For defenders, the priority is therefore clear: patch the vulnerable FortiOS or FortiProxy release, validate whether Security Fabric created an exploitable condition, reduce management-plane exposure, and investigate whether the appliance was already compromised before remediation.
The larger lesson is equally important.
A firewall should be one of the systems enforcing trust.
When the firewall’s own authentication boundary fails, the attacker is no longer simply trying to get through the perimeter.
They may be controlling it.
Spanish 
English 
German 
French 
Portuguese 
Japanese 
Korean 
Hindi 
Arabic 
Turkish 
Hebrew