CVE-2025-24472

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 3.6%; technical severity is CVSS 8.1.

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.

Who should care

• Teams operating FortiOS, FortiOS and FortiProxy, Fortiproxy
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether FortiOS, FortiOS and FortiProxy, Fortiproxy is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Fortinet Security advisory FG IR 24 535
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-288

Affected versions

Fortinet FortiOS (Start Including 7.0.0, End Excluding 7.0.17); Fortinet FortiOS and FortiProxy; Fortinet Fortiproxy (Start Including 7.0.0, End Excluding 7.0.20 | Start Including 7.2.0, End Excluding 7.2.13)

Fixed versions

Fortinet FortiOS (Fixed from 7.0.17); Fortinet Fortiproxy (Fixed from 7.0.20, 7.2.13)

Published

11 February 2025

Attack vector

Network

Privileges required

None

User interaction

None

Signal timeline

1. 11 Feb 2025CVE published
2. 17 Mar 2025Added to CISA KEV
3. 22 Aug 2026Latest EPSS score: 3.6%
4. 19 Aug 2026 · 12:58 UTCSignal calculated at 70

External references

• CISA Government advisory CVE-2025-24472 ↗