CVE WatchAug 5, 2026

CVE-2025-24472

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

CVSS

8.1

High

EPSS

7.2%

p94

KEV

YES

Mar 18, 2025

Exploit Today

0-100

Published: Feb 11, 2025 · Last modified: Aug 5, 2026 · CWE-288

EPSS · 30d

7.1%EPSS · 30 days7.2%

2026-09-162026-10-14

KEV catalog record

Product

Fortinet / FortiOS and FortiProxy

Vulnerability

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Added to KEV

Mar 18, 2025

Remediate by

Apr 8, 2025

Known ransomware use

Yes

Summary description

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24472

Technical description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-19863—

—

———An unauthenticated client may access certain protected resources when using EthereumAuthenticator if the request path contains the configured login path. This is caused by the authenticator using an unanchored substring match when identifying the login page. If the login path appears later within a protected request path, the request may be treated as the login page and its authentication or role requirement replaced with ALLOWED. Exploitation requires the protected resource path to contain the configured login path as a later segment. Explicitly FORBIDDEN routes are not affected.6h CVE-2026-110852—

—

——0n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.6h CVE-2026-890678.8 HIG

—

——0Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.5h CVE-2026-858655.5 MED

19.8%

——6Improper authentication in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.2d CVE-2026-837875.5 MED

19.8%

——6Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally.1d CVE-2026-11013010.0 CRI

45.2%

——14Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account.1d