CVE-2024-55591 is an authentication bypass vulnerability in Fortinet FortiOS and FortiProxy. CISA added it to the Known Exploited Vulnerabilities catalogue on 14 January 2025, which means attackers have used it in real attacks. Organisations running the affected product should apply the vendor fix or mitigation as a priority.
What this vulnerability class means in FortiOS and FortiProxy
An authentication bypass means the product can accept requests without properly proving who is on the other end. In edge products such as Fortinet FortiOS and FortiProxy, that matters because these systems often sit directly in front of internal networks, remote access paths, and security policy enforcement points.
When authentication fails at that layer, the attacker is not just reaching a single application feature. They may be able to cross a trust boundary, reach administrative interfaces, or pivot into services that were assumed to be protected by login controls. That is why bypass flaws in perimeter and proxy products are treated as high-consequence exposure, especially when CISA has already listed the issue in the KEV catalogue.
Why this kind of bypass is operationally dangerous
The danger is not limited to unauthorized sign-in. A successful bypass can undermine access control decisions, session trust, and downstream monitoring because the system may record activity as if it were legitimate. In practice, that can make malicious access look like normal traffic until the attacker starts changing configuration, exfiltrating data, or establishing persistence.
For internet-facing security appliances, the blast radius is often larger than the product itself. If the device brokers remote access, authentication, or traffic filtering for many users and services, one flaw can expose multiple internal assets at once. That is why vendor advisories and the NIST National Vulnerability Database should be checked alongside the product advisory when assessing exposure.
How organisations confirm exposure and scope
Start with asset inventory, because the first question is whether FortiOS or FortiProxy is present anywhere in the environment. Then determine whether any instance is internet-facing, used for remote access, or positioned in a way that would make unauthenticated access especially valuable to an attacker.
Exposure review should also include configuration review and vendor guidance, since some vulnerabilities are only dangerous under particular deployment patterns or feature combinations. The CVE Program gives the authoritative identifier for the issue, while the vendor advisory provides the exact remediation and mitigation details for the affected product line.
Where a device is shared across business units, treat the check as both a security task and a dependency review. A single perimeter appliance can concentrate risk if it controls authentication, web filtering, VPN entry, or proxy egress for many users and systems.
Remediation, detection, and post-patch review
Priority should go to the vendor fix or approved mitigation, because authentication bypasses are not the kind of weakness that can be safely accepted for long. If immediate patching is not possible, isolate the device as much as operationally feasible and reduce exposed management or remote-access paths until the issue is resolved.
Detection should focus on signs that the appliance was accessed before remediation, including unexpected admin actions, configuration drift, strange login patterns, and activity from unfamiliar source networks. After patching, organisations should review logs and adjacent systems for signs of compromise, because attackers may have used the bypass only as the entry point and then moved on to credential theft, persistence, or lateral movement.
If the device guarded privileged access, rotating credentials and reviewing sessions can be material. A bypass in a security gateway can invalidate assumptions about which accounts, sessions, or trust tokens remained confidential during the exposure window.
Risk and Threat Considerations
This vulnerability class is high-risk because it can turn a trusted access control point into an unauthenticated entry path. When the vulnerable product sits on the internet or fronts internal authentication flows, an attacker can use the bypass to reach sensitive services without first defeating normal login barriers.
Failure mechanism: The appliance accepts requests that should have been blocked by authentication logic, so the attacker inherits the trust of a valid user or administrator and can proceed into management, proxy, or remote-access functions.
Impact: That can lead to unauthorized configuration changes, session abuse, data exposure, or follow-on compromise of connected systems, especially when the device is a central control point for many users.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | A bypass in an edge appliance makes secure configuration and exposed-service control central. |
| Recommendation — Review and harden exposed Fortinet configurations, then remove unnecessary access paths. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | The issue is an authentication bypass that defeats organizational user sign-in control. |
| SI-2 — Flaw Remediation | CVE-2024-55591 requires prioritized remediation of a known exploited flaw. | |
| Recommendation — Enforce strong organizational authentication and verify the appliance cannot bypass it. Apply the vendor fix or approved mitigation as soon as possible and verify closure. | ||
| NIST CSF 2.0 | PR.AA-01 — Identity Management, Authentication and Access Control | The vulnerability undermines access control decisions at a trusted perimeter device. |
| DE.CM-01 — Networks and network services are monitored to detect potential cybersecurity events | Post-exploit review depends on monitoring the appliance and its connected services for misuse. | |
| Recommendation — Validate that access control is enforced at the appliance and not assumed by network position. Monitor logs and network activity around the appliance for signs of unauthorized access. | ||
Practitioner Guidance
Why practitioners should care: Treat this as a perimeter trust failure, not a routine software bug. If the appliance mediates access for critical users or workloads, the operational impact of delayed remediation is usually larger than the impact of the vulnerable product alone.
What to watch for: Focus on exposed instances, unusual admin activity, unexplained configuration changes, and signs that authentication controls were bypassed before the fix was applied. Where compromise is suspected, review adjacent identities, sessions, and management paths, not just the appliance itself.
Practitioner takeaway: For KEV-listed authentication bypasses in edge security products, the safest assumption is that exposure may already have been attempted, so validate scope and investigate before and after remediation.
Related resources from NHI Mgmt Group
- CVE-2025-24472 (Fortinet FortiOS and FortiProxy Authentication Bypass)
- CVE-2024-0012 (Palo Alto Networks PAN-OS Management Interface Authentication Bypass)
- CVE-2023-27997 (Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow)
- CVE-2020-12812 (Fortinet FortiOS SSL VPN Improper Authentication)