“An Authentication Bypass Using an Alternate Path or Channel vulnerability affecting FortiOS and FortiProxy may allow a remote attacker to gain super-admin privileges via crafted CSF proxy requests,” states the Fortinet advisory. The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical security alert highlighting a significant vulnerability in Fortinet’s FortiOS and FortiProxy systems, which threat actors are actively exploiting. Security experts warn that successful exploitation could provide attackers full administrative access to affected systems, including creating rogue admin accounts, modifying firewall policies, and accessing SSL VPNs to penetrate internal networks. The authentication bypass vulnerability, tracked as CVE-2025-24472, has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation in ransomware campaigns. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Security teams should also monitor logs for suspicious activities, such as unexplained administrative logins from the “jsconsole” interface or the creation of admin accounts with random usernames. Organizations are advised to use the KEV catalog as a critical input to their vulnerability management prioritization framework, making it an essential component of effective external attack surface management. This authentication bypass vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) by the Common Weakness Enumeration.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 19 Mar 2025 06:35:03 +0000