What breaks and who should care
If your network relies on FortiOS or FortiProxy, the authentication bypass identified as CVE-2025-24472 is a direct threat to the confidentiality and integrity of your whole environment. It allows a remote attacker to obtain super‑admin rights simply by sending a specially crafted CSF proxy request. Anyone who manages a Fortinet firewall or proxy should treat this as a top‑priority item – especially if the device is exposed to the internet or sits in a DMZ.
Related remediation guides
Other vulnerabilities in the same family or affecting the same products:
- CVE-2024-55591 – Immediate Action Guide for FortiOS and FortiProxy
- CVE-2025-29927 – Critical Next.js Authorization Bypass – Immediate Action Required
- CVE-2026-35273 – Critical PeopleSoft PeopleTools Authentication Bypass
For the wider picture, our Known Exploited Vulnerabilities tracker lists every flaw CISA has confirmed under active attack.
Technical overview
The vulnerability sits in the way FortiOS/FortiProxy validates authentication tokens for proxy requests that travel over the CSF (Control and Status Framework) channel. Normally, a request must carry a valid session that proves the caller has already logged in with sufficient privileges. The flaw bypasses that check, meaning the device treats the request as coming from a fully‑trusted administrator without any proof.
From a classification standpoint, this is an authentication bypass – a class of bugs that let an unauthenticated user appear as an authenticated one. The exact code path and the specific parsing error have not been disclosed publicly, but the impact is clear: once the attacker gains super‑admin rights they can change firewall policies, extract logs, install backdoors, or even trigger ransomware payloads, as seen in recent campaigns.
Exploit code has been observed in the wild. CISA added the issue to its Known Exploited Vulnerabilities catalog on 2025‑03‑18, and the agency notes that ransomware groups have used the bug to gain a foothold before encrypting data. The CVSS score of 8.1 places the flaw solidly in the high severity range.
Impact assessment
Super‑admin access on a Fortinet device is the highest level of control you can have. With that power an attacker can:
- Modify or delete security policies, opening the network to further intrusion.
- Extract configuration files that contain credentials and network topology.
- Disable logging or alter log forwarding, hiding their activity.
- Install malicious firmware or scripts that persist across reboots.
- Launch ransomware encryption against attached storage or downstream systems.
Because the vulnerability works over the network, there is no need for the attacker to have any prior foothold. If the device is reachable from the internet, the risk is especially acute. Even internal‑only deployments are not safe if lateral movement is possible; a compromised host could send the crafted request directly to the firewall.
How to determine if you are exposed
The first step is to confirm which Fortinet product and firmware branch you are running. On a FortiGate or FortiProxy you can retrieve the current version with the CLI command:
get system status
The output includes a line labelled “Version”. Note the version string and compare it against the table below. If your version falls anywhere between the earliest listed release and the fixed release for your branch, you are vulnerable.
If you manage the device through the web UI, the version appears on the dashboard under “System Information”. Again, match it to the table.
Because the table is generated automatically from the NVD, it will always show the correct range of affected and patched releases. Do not rely on memory of version numbers – the table is the authoritative source.
Mitigation steps when a patch is available
The vendor has released a patched build for each affected branch. The recommended action is to upgrade to the patched release for your branch as soon as possible. The upgrade process is straightforward:
- Download the appropriate firmware image from the Fortinet support portal. Choose the image that matches your product line and the branch you are already on.
- Back up the current configuration. Use
execute backup config flashor the equivalent UI option to store a copy of the running config. - Upload the firmware via the web UI (System > Firmware) or via the CLI with
execute restore image filename. - Reboot the device when prompted. After reboot, verify the version again with
get system status.
After the upgrade, confirm that the vulnerability is no longer present by re‑checking the version against the table. Also, review the change log for any additional security hardening recommendations.
Temporary mitigations if you cannot patch immediately
Fortinet publishes a set of mitigations that can reduce the attack surface while you arrange a full upgrade. Apply them in the order below:
- Restrict management access. Limit inbound connections to the device’s admin ports (HTTPS, SSH, and the CSF port) to a handful of trusted IP addresses. Use an upstream firewall or ACL to enforce this.
- Disable unused proxy services. If you are not using the CSF proxy feature for legitimate traffic, turn it off in the configuration. This removes the code path the attacker needs.
- Enforce strong authentication. Enable two‑factor authentication for all admin accounts. Even though the flaw bypasses token checks, strong MFA adds an extra hurdle for any subsequent exploitation attempts.
- Monitor for suspicious CSF traffic. Enable detailed logging for CSF requests and set up an alert for any request that originates from an unexpected source or contains malformed headers.
These steps do not eliminate the vulnerability, but they make it significantly harder for an attacker to reach the vulnerable code path.
What to do if a patch is unavailable for your environment
In rare cases an organisation may be locked onto a specific firmware branch that has not yet received a fix. In that scenario you have two options:
- Isolate the device. Place it behind a separate, tightly controlled network segment and block any inbound traffic that does not originate from known management stations.
- Consider decommissioning or replacing the device. If you cannot apply a patch or sufficient mitigations, the risk outweighs the benefit of keeping the appliance in production.
While you work on a longer‑term solution, continue to apply the temporary mitigations listed above and keep an eye on Fortinet security advisories for a forthcoming release.
Compliance and reporting guidance
CISA’s directive requires organisations to either apply the vendor’s mitigations, follow the BOD 22‑01 guidance for cloud‑based services, or discontinue use of the vulnerable product. Document the steps you have taken – version check, mitigations applied, upgrade schedule – and retain that evidence for audit purposes.
If you belong to a regulated sector (for example, PCI‑DSS or HIPAA), you should treat this as a critical finding in your vulnerability management program and report it according to your internal incident‑response policy.
Summary checklist
- Identify the FortiOS/FortiProxy version with
get system status. - Compare the version to the table below – if it falls in the affected range, you are vulnerable.
- Upgrade to the patched release for your branch as soon as possible.
- If you cannot upgrade immediately, restrict management access, disable unused CSF services, enable MFA, and monitor CSF logs.
- Document all actions for compliance and incident‑response reporting.
Time is of the essence. The vulnerability is already being used by ransomware operators, and the CVSS score reflects a high likelihood of impact. Follow the steps above, get the firmware updated, and you’ll close the most dangerous attack vector this bug creates.
Version table
The table below lists the affected and fixed releases for each FortiOS and FortiProxy branch. Use it as the definitive source for your version comparison.
Affected versions
Straight from the NVD record for CVE-2025-24472. If your build is inside one of these ranges, treat it as vulnerable.
| Product | Affected range | Fixed in |
|---|---|---|
fortiproxy |
7.0.0 up to 7.0.20 | 7.0.20 |
fortiproxy |
7.2.0 up to 7.2.13 | 7.2.13 |
fortios |
7.0.0 up to 7.0.17 | 7.0.17 |
