CVE Watch8 jul 2026

CVE-2025-24472

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

CVSS

8.1

Alto

EPSS

3.1%

p86

KEV

SÍ

18 mar 2025

Exploit Today

0-100

Publicado: 11 feb 2025 · Última mod.: 8 jul 2026 · CWE-288

EPSS · 30d

3.0%EPSS · 30 días3.1%

2026-06-302026-07-16

Ficha del catálogo KEV

Producto

Fortinet / FortiOS and FortiProxy

Vulnerabilidad

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Añadido a KEV

18 mar 2025

Remediar antes de

8 abr 2025

Uso conocido en ransomware

Sí

Descripción resumida

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24472

Descripción técnica

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2024-555919.8 CRÍ

99.9%

KEV—80Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability8d CVE-2018-13382—

99.6%

KEV—80Fortinet FortiOS and FortiProxy Improper Authorization—CVE-2018-13383—

98.2%

KEV—79Fortinet FortiOS and FortiProxy Out-of-bounds Write—CVE-2026-445757.5 ALT

71.8%

——22Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route variants used for segment prefetching. In affected configurations, specially crafted .rsc and segment-prefetch URLs can resolve to the same page without being matched by the intended middleware rule, which can allow protected content to be reached without the expected authorization check. This vulnerability is fixed in 15.5.16 and 16.2.5.11h CVE-2023-370579.8 CRÍ

56.2%

——17An issue in JLINK Unionman Technology Co. Ltd Jlink AX1800 v.1.0 allows a remote attacker to execute arbitrary code via the router's authentication mechanism.8d CVE-2026-400228.2 ALT

45.8%

——14When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via camel.server.path or camel.management.path, the BasicAuthenticationConfigurer and JWTAuthenticationConfigurer classes derive the authentication path from properties.getPath() when camel.server.authenticationPath / camel.management.authenticationPath is not explicitly set. Combined with the Vert.x sub-router mounting model - the sub-router is mounted at _path_* and the authentication handler is registered inside the sub-router at the resolved path - this causes the authentication handler to match only the exact configured context path, not its subpaths. Unauthenticated requests to subpaths such as /api/_route_ or /admin/observe/info therefore reach protected business routes and management endpoints without being challenged for credentials. The /observe/info endpoint can disclose runtime metadata such as the user, working directory, home directory, process ID, JVM and operating system information. This issue affects Apache Camel: from 4.14.1 before 4.14.6, from 4.18.0 before 4.18.2. Users are recommended to upgrade to version 4.20.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, they are suggested to upgrade to 4.14.6. If users are on the 4.18.x LTS releases stream, they are suggested to upgrade to 4.18.2.2d