CVE-2025-24472 is an authentication bypass vulnerability in Fortinet FortiOS and FortiProxy. CISA added it to the Known Exploited Vulnerabilities catalogue on 18 March 2025, which means attackers have used it in real attacks. Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.
Why this vulnerability matters in FortiOS and FortiProxy
CVE-2025-24472 is dangerous because it breaks the normal trust boundary at the authentication layer. When a remote attacker can bypass authentication and reach super-admin privileges through crafted CSF proxy requests, the issue is no longer limited to ordinary account misuse, it becomes full device compromise potential on internet-facing security infrastructure.
This class of flaw is especially severe in network security products because they often sit at a control point for remote access, traffic inspection, policy enforcement, and administrative control. If the appliance itself is bypassed, every downstream trust decision made by that device can be affected.
How organisations assess exposure to this CVE
Exposure checks should start with an accurate inventory of FortiOS and FortiProxy assets, including cloud-hosted, branch, lab, and forgotten test instances. Organisations should then confirm which systems are internet-exposed, which administrative interfaces are reachable, and whether the vendor advisory identifies the product builds in scope for remediation.
Because this vulnerability was added to the CISA Known Exploited Vulnerabilities catalogue, it should be treated as an active exploitation risk rather than a theoretical weakness. For authoritative version and patch detail, readers should rely on the CVE Program entry and the NIST National Vulnerability Database, alongside Fortinet’s own advisory.
Remediation and compensating controls
The primary fix is vendor remediation, but organisations often need temporary risk reduction while maintenance windows, change freezes, or dependency issues delay patching. In that gap, the focus should be on reducing reachable attack surface, tightening administrative exposure, and increasing monitoring around the affected appliances.
Where immediate patching is not possible, compensating controls should assume the device may already be a high-value target. That means restricting management access to trusted networks, removing unnecessary exposure, reviewing proxy and admin paths, and treating any unusual configuration change as a potential sign of abuse.
Detection and post-exploitation review
Detection should not stop at the appliance banner or login failure logs. If attackers can gain super-admin privileges, they may alter policy, create persistence, weaken logging, or use the device as a pivot point for broader network access. Review administrative actions, configuration changes, new accounts, policy edits, and any signs that the appliance stopped behaving like a trusted control plane.
After remediation, organisations should also review for secondary compromise. If the appliance was abused to reach management interfaces or internal services, rotate any credentials, tokens, or secrets that were accessible from the device’s privileged context and validate that no attacker-added access paths remain.
Risk and Threat Considerations
Because this is an authentication bypass in a perimeter security product, the main risk is not just unauthorized login, it is loss of control over the controls themselves. A successful exploit can let an attacker change policy, observe traffic, or use the appliance as a staging point for wider intrusion.
Failure mechanism: Crafted CSF proxy requests bypass the authentication boundary and can elevate a remote attacker to super-admin level, defeating the trust model that protects administrative functions.
Impact: The attacker may gain full administrative control, alter security policy, persist on the device, and expand access into connected networks or management planes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | CVE-2025-24472 breaks admin authentication on a security appliance. |
| IA-5 — Authenticator Management | Credential and session material must be protected after an auth-bypass compromise. | |
| AC-6 — Least Privilege | Super-admin compromise is a direct privilege escalation and authorization failure. | |
| Recommendation — Harden administrative authentication and review any device access paths that rely on it. Rotate exposed authenticators and invalidate any sessions that could be trusted by the device. Minimise administrative privilege on the appliance and separate high-impact functions. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | The flaw affects exposed appliance configuration and admin interfaces. |
| CIS-7 — Continuous Vulnerability Management | KEV inclusion makes exposure assessment and remediation prioritisation material. | |
| Recommendation — Reduce management exposure and enforce secure appliance configuration baselines. Prioritise vulnerable FortiOS and FortiProxy assets for rapid remediation and verification. | ||
Practitioner Guidance
Why practitioners should care: Treat KEV-listed authentication bypasses in edge security products as urgent operational exposure, not routine backlog work. The device is part of the security stack, so compromise can undermine multiple downstream controls at once.
What to watch for: Prioritise assets that are externally reachable, administratively exposed, or already showing unexplained policy drift, unexpected privilege changes, or unusual CSF proxy activity. Those are the systems most likely to merit immediate verification and containment.