CVE-2024-55591: FortiOS and FortiProxy authentication bypass via Node.js websocket

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote super-admin access with a 9.8 CVSS score, KEV listing, ransomware use and near-maximum EPSS makes this an urgent patch-first issue.

What it is

FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 contain an authentication bypass (CWE-288) reachable through crafted requests to the Node.js websocket module. A remote, unauthenticated attacker can obtain super-admin privileges, making this a full compromise of the affected appliance. It is listed in CISA KEV with known ransomware campaign use, so it is being exploited in the wild.

Impact

An attacker gains super-admin privileges on the device, allowing full control of firewall, proxy and VPN configuration and any credentials or traffic handled by it. That level of access can be used to pivot into the protected network and to disable or alter security controls.

Attack surface

The flaw is network-reachable (CVSS AV:N) with no privileges and no user interaction required (PR:N, UI:N), reached by sending crafted requests to the Node.js websocket module. No authentication is needed, so any host that can reach the exposed service can attempt it.

Exploitation

CISA added it to KEV on 2025-01-14 with a 2025-01-21 remediation due date and flags known ransomware campaign use; EPSS is 0.98259 (99.9th percentile), indicating very high likelihood of exploitation. The vendor advisory is tagged Mitigation and Vendor Advisory, so patched or mitigated versions exist.

What to do

• Apply the Fortinet fixes for FortiOS and FortiProxy per FG-IR-24-535, upgrading off the listed vulnerable ranges.
• If immediate patching is not possible, apply the vendor's documented workarounds or discontinue exposure of the affected management interface as CISA directs.
• Restrict access to administrative and websocket interfaces to trusted management networks; do not expose them to the internet.
• Rotate administrative credentials and any secrets stored on affected devices after remediation, since super-admin access may have been obtained.
• Monitor for and investigate signs of prior compromise before assuming the device is clean.

Detection

• Review FortiOS and FortiProxy logs for unexpected administrative logins, new admin accounts, or configuration changes originating from untrusted source IPs.
• Hunt for anomalous or malformed requests to the Node.js websocket service and for management-interface access from external or unexpected networks.
• Correlate device logs with network telemetry for post-exploitation activity such as new VPN users, firewall rule changes, or outbound connections from the appliance.
• Check for indicators published by Fortinet and CISA for this CVE and search historical logs for matching activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.