FortiOS and FortiProxy Authentication Bypass (CVE-2025-24472)

Historical catalog analysis: CISA added this entry on March 18, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-24472 is an authentication bypass vulnerability affecting Fortinet FortiOS and FortiProxy. The flaw allows a remote attacker to send crafted CSF proxy requests to the affected system, which could enable the attacker to gain super-admin privileges without valid credentials.

CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on March 18, 2025. Notably, CISA has marked this vulnerability as ‘Known’ for use in ransomware campaigns, indicating that threat actors are actively leveraging this path to compromise systems.

Exposure and applicability

This vulnerability is highly relevant to healthcare organizations that rely on FortiOS or FortiProxy for perimeter security, VPN gateways, or internal network segmentation. Because these tools often sit at the edge of the network to protect electronic Protected Health Information (ePHI), a super-admin compromise could grant an attacker broad access to the internal environment.

Healthcare security leaders should verify if their current deployments include these products and consult the vendor’s PSIRT advisory to determine if their specific versions are affected. While CISA has set a remediation deadline of April 8, 2025, for federal agencies, this date serves as a critical risk indicator for private healthcare providers regarding the urgency of the threat.

Remediation priorities

Based on our analysis of the vulnerability’s impact and its association with ransomware, we suggest the following prioritized actions:

1. Immediate Version Audit: Identify all instances of FortiOS and FortiProxy across the clinical and administrative networks. This is a prerequisite for any patching or mitigation effort.
2. Apply Vendor Mitigations: Prioritize the application of patches or mitigations as specified in the vendor’s PSIRT instructions to close the authentication bypass path.
3. Restrict Management Access: As a damage-limiting measure, ensure that administrative interfaces are not exposed to the public internet and are restricted to trusted management networks.
4. Review Administrative Logs: Examine logs for unauthorized super-admin logins or unusual CSF proxy requests that may indicate attempted exploitation.

How to validate remediation

To verify that exposure has been reduced, organizations should:
* Confirm Versioning: Cross-reference the installed firmware versions against the vendor’s list of fixed releases. A version check is a primary indicator but does not guarantee total security.
* Verify Access Controls: Confirm through network scanning or configuration audits that management interfaces are unreachable from untrusted zones.
* Audit Account Privileges: Review the super-admin account list to ensure no unauthorized accounts were created during the window of vulnerability.

Limits and open questions

Applying patches could reduce the likelihood of exploitation, but it does not guarantee prevention against all future variants of this attack. There remains a residual risk if an attacker has already established persistence within the network prior to the patch being applied.

Furthermore, because this vulnerability involves crafted proxy requests, organizations should coordinate with their clinical engineering teams when updating perimeter devices to ensure that critical medical device traffic and patient care workflows are not interrupted during the update process.

Source and editorial note

CVE-2025-24472: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability · Source date: March 18, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: March 21, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 18, 2026 at 00:53 UTC.

Request a healthcare security assessment