Is CVE-2025-24472 (Fortinet FortiOS and FortiProxy Authentication Bypass) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2025-24472 to its Known Exploited Vulnerabilities catalogue on 18 March 2025, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.

What the Exploitation Signal Means for FortiOS and FortiProxy

The practical question is not whether the bug exists, but whether it has crossed from a theoretical weakness into an active intrusion path. CISA's KEV listing means defenders should treat this as exploited code, not a routine vulnerability management item. For internet-facing appliances, that changes triage order: exposure, access path, and compromise checking all move ahead of normal maintenance windows.

Because the flaw is an authentication bypass, the security boundary being broken is the trust model around administrative access. A remote attacker who can send crafted CSF proxy requests may not need prior credentials, so the first control question is whether the device is reachable from untrusted networks and whether administrative interfaces or proxy functions are exposed in ways that expand attack surface.

For readers tracking appliance exposure patterns, NHIMG's Edge Device Security Guide is the most relevant internal starting point because the same hardening logic applies to perimeter devices, management exposure, logging, and emergency patching.

Why This Becomes a Privilege Escalation and Incident-Response Problem

This kind of bypass is dangerous because it does not just let an attacker sign in, it can collapse the privilege model if the product's management plane is reachable. In this case, the direct answer states that exploitation can yield super-admin privileges, which makes the flaw a high-value entry point for persistence, configuration tampering, traffic interception, or further lateral movement inside the network.

When a perimeter device is the target, compromise can affect many downstream systems at once. Attackers often use appliance access to harvest credentials, alter routing or inspection settings, and hide follow-on activity behind trusted network infrastructure. The concern is therefore not limited to the appliance itself, it is the control plane that the appliance protects.

For a broader exploitation context, the CISA Known Exploited Vulnerabilities Catalog is the authoritative signal that this is a confirmed exploitation case, while the FIRST EPSS project is useful for comparing exploitation likelihood across your backlog when you are deciding what else should be accelerated.

What to Do If You Cannot Patch Immediately

If patching must wait, the priority is to reduce reachable attack surface and preserve evidence. That usually means restricting management access to trusted networks, reviewing any exposed proxy or admin paths, and checking whether the device is reachable from the public internet or through partner links that were never intended for administrative use. You should also preserve logs before making disruptive changes, because appliance logs are often the only record that shows whether the bypass has already been used.

The other immediate question is blast radius. If the device has handled administrative sessions, stored credentials, or privileged tokens, treat those as potentially exposed and plan for rotation where appropriate. The exact follow-up depends on what the device protects, but the rule is simple: if the compromised boundary can authenticate or authorize further access, assume the attacker may have used that trust already.

NHIMG's Vulnerability Management Guide fits here because it covers the practical sequence of exception handling, verification, and post-patch validation for vulnerabilities that are already being exploited.

Risk and Threat Considerations

An authentication bypass on a security appliance is especially dangerous because it targets the device that many organisations trust to mediate other traffic and administrative access. If the appliance is internet-facing, the attacker may need only one successful request path to convert a perimeter weakness into privileged control.

Failure mechanism: Crafted CSF proxy requests bypass normal authentication checks, allowing a remote attacker to reach administrative functions and obtain super-admin privileges. From there, the attacker can modify settings, create persistence, or use the appliance as a foothold for broader compromise.

Impact: The likely consequences include appliance takeover, loss of trust in network controls, credential exposure, traffic redirection, and follow-on compromise of connected systems. Because CISA lists the CVE in KEV and notes ransomware use, defenders should treat delayed action as a materially elevated operational and extortion risk.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited CVEs require rapid prioritisation and remediation.
Recommendation — Prioritise exposed appliances for emergency remediation and exception tracking.
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	KEV-listed exploitation should drive risk-based prioritisation and escalation.
Recommendation — Escalate KEV-listed assets into emergency risk treatment and remediation.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	This CVE demands exposure confirmation, tracking, and remediation verification.
	SI-2 — Flaw Remediation	Active exploitation makes timely remediation and compensating controls essential.
	AU-6 — Audit Record Review, Analysis, and Reporting	Compromise checks depend on reviewing appliance logs and administrative events.
Recommendation — Scan for affected appliances and verify remediation before closing the risk. Apply the fix or mitigation urgently and document any temporary exception. Review appliance audit logs for exploitation and post-access configuration changes.

Practitioner Guidance

What to prioritise: Triage exposure first. Confirm whether any FortiOS or FortiProxy instance is reachable from untrusted networks, then determine whether it is used for administrative access, VPN, proxy, or inspection functions that would magnify the blast radius of compromise.

What to verify: Look for signs of earlier compromise before or alongside remediation, especially unusual admin changes, new accounts, configuration drift, proxy rule changes, and unexpected authentication events. If the appliance has been used as a trust anchor, verify whether credentials, sessions, or downstream access paths should be rotated or revoked.

Decision rule: If the device is exposed and the fix cannot be applied immediately, reduce access to the smallest trusted set, preserve logs, and treat the appliance as a potential incident source until you can confirm otherwise.

Practitioner takeaway: Once a security appliance vulnerability is confirmed as actively exploited, the correct response is not just patching, it is exposure reduction, compromise assessment, and trust revalidation across anything the appliance could authorize.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org