CVE-2025-24472: FortiOS and FortiProxy authentication bypass via crafted CSF proxy requests

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is a remotely exploitable, unauthenticated authentication bypass leading to super-admin access, listed in CISA KEV with known ransomware use and a near-term remediation deadline.

What it is

FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12 and 7.0.0 through 7.0.19 contain an authentication bypass (CWE-288) in the Security Fabric. A remote unauthenticated attacker who already knows the serial numbers of upstream and downstream devices can send crafted CSF proxy requests to gain super-admin privileges on the downstream device when the Security Fabric is enabled.

Impact

Successful exploitation grants super-admin privileges on the downstream device, giving the attacker full control of the affected firewall or proxy appliance.

Attack surface

Reachable remotely over the network with no authentication and no user interaction, but exploitation requires the Security Fabric to be enabled and prior knowledge of upstream and downstream device serial numbers, which is reflected in the CVSS vector's high attack complexity.

Exploitation

CVE-2025-24472 is listed in CISA KEV with a due date of 2025-04-08 and is flagged for known ransomware campaign use; EPSS 30-day probability is 0.07106 (93.9th percentile).

What to do

• Upgrade FortiOS and FortiProxy to vendor-fixed versions per Fortinet advisory FG-IR-24-535.
• If patching is not immediately possible, apply the vendor's documented workarounds or mitigations, or discontinue use of the affected product.
• Disable the Security Fabric on affected devices where it is not operationally required.
• Restrict management and CSF-related interfaces from untrusted networks and monitor for unauthorized configuration changes.
• Treat device serial numbers as sensitive and review exposure of that information in logs, portals and support channels.

Detection

• Audit FortiOS and FortiProxy logs for unexpected super-admin account creation or privilege changes.
• Monitor for anomalous CSF proxy requests, especially from unexpected source addresses or with unusual serial number values.
• Alert on configuration changes to Security Fabric settings or administrative users outside change windows.
• Correlate network telemetry for access to management or CSF ports from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.