CVE-2025-24472: patch FortiOS and FortiProxy Security Fabric authentication bypass

Status — 4 November 2026: Confirmed. CISA lists CVE-2025-24472 in its Known Exploited Vulnerabilities (KEV) catalogue. The CVE record was published on 11 February 2025; this is a still-current, wider-window selection, not a newly published CVE.

Field	Verified detail
CVE	CVE-2025-24472
Product	Fortinet FortiOS and FortiProxy, with Security Fabric enabled
Affected releases	FortiOS 7.0.0–7.0.16; FortiProxy 7.0.0–7.0.19 and 7.2.0–7.2.12
Fixed releases	FortiOS 7.0.17; FortiProxy 7.0.20 and 7.2.13 respectively
CVSS	8.1 (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Exploitation	Confirmed by CISA as active exploitation; KEV added 18 March 2025
KEV / EPSS	KEV: yes, checked 4 November 2026. EPSS is a changing estimate: consult FIRST EPSS on the day of triage; it is not evidence of compromise.
Editorial priority	High for organisations operating Fortinet appliances with Security Fabric enabled, especially management-plane reachable systems.

What this vulnerability is

CVE-2025-24472 is an authentication-bypass issue in the Security Fabric (CSF) proxy path. Fortinet’s advisory and the CVE record say that a remote, unauthenticated attacker who already knows upstream and downstream device serial numbers may obtain super-admin privileges on a downstream device through crafted CSF proxy requests.

That condition matters. Confirmed: the affected release ranges, the Security Fabric condition, CISA KEV inclusion and known ransomware-campaign use. Not confirmed by these sources: that every Fortinet appliance is exposed, that an individual appliance has been accessed, or that a public web-management port alone proves susceptibility. Do not test this by sending crafted requests.

Are you affected?

Start with inventory and configuration, not a probe. On each owned FortiGate/FortiProxy appliance, a privileged administrator can record the version:

get system status

Expected result: output including a line such as Version: FortiGate-... v7.0.16 or the FortiProxy equivalent. A version in an affected range means potentially affected; a fixed version means this specific CVE is remediated by version, subject to confirming the running image after reboot.

Then inspect Security Fabric configuration in the GUI: Security Fabric → Settings. Record whether Security Fabric connection settings are enabled and whether the device participates as a downstream device. In the CLI, use the read-only configuration view appropriate to the appliance:

show system csf

Expected result: the active CSF settings. Preserve this output in the change record. If Security Fabric is disabled, the documented vulnerable feature condition is not present; this does not prove the appliance has no other exposure.

For an owned public hostname, an optional NetTools.tech DNS Lookup can document where the name resolves. Input: the appliance’s own hostname. Result: its A/AAAA records. Limit: DNS answers do not prove that administration is internet-exposed, that CSF is enabled, or that the CVE is exploitable. Do not run active scans against systems you do not own or lack written permission to assess.

Patch: vendor-supported route

Fortinet’s fixed-version boundaries are FortiOS 7.0.17 and FortiProxy 7.0.20 (7.0 branch) or 7.2.13 (7.2 branch). Choose the fixed release that matches the supported train approved for the appliance; do not downgrade only to satisfy this article.

Prerequisites

1. Confirm the appliance model supports the selected target image and read Fortinet’s release notes for its upgrade path.
2. Take an encrypted configuration backup and retain the current firmware image or documented rollback path.
3. Schedule a maintenance window: the appliance reboots and interrupts traffic.
4. Ensure out-of-band console access or a tested break-glass management route.

GUI steps

1. Sign in to the appliance’s management interface from an authorised administration network.
2. Open System → Firmware (the label varies slightly by FortiOS/FortiProxy release).
3. Select the approved fixed image: 7.0.17+ for affected FortiOS; 7.0.20+ or 7.2.13+ for affected FortiProxy.
4. Select Backup configuration and upgrade if offered, then confirm the reboot.
5. Wait for the appliance to return and sign in again.

Expected result: the firmware page and get system status both show the selected fixed version. Validate essential traffic, HA health if applicable, VPNs, routing and Security Fabric connectivity before closing the change.

CLI validation

After the reboot, run:

get system status
get system ha status

Expected result: the first command shows a fixed release; the second should show the expected HA role and peer state where HA is used. Compare pre- and post-change CSF configuration with the backup.

Rollback

Use only the model- and release-specific rollback procedure in Fortinet’s release notes, from console or the approved recovery route. Restoring an old vulnerable image reintroduces this CVE, so roll back only to restore service, then engage Fortinet support and plan a supported fixed path. Do not restore a configuration blindly if schema changes were made during upgrade.

Temporary containment when patching cannot happen immediately

The vendor-supported remediation is upgrade. Until the approved window, reduce exposure without claiming a full fix:

• restrict management and Security Fabric-related access to required, trusted administration networks using the organisation’s existing local-in policy and management controls;
• remove unnecessary public management exposure;
• review administrator accounts, recent configuration changes and Security Fabric topology;
• preserve logs and configuration before making containment changes.

These controls can reduce reachability; they do not remove the affected code path. Treat a device in the stated affected ranges with Security Fabric enabled as a patch priority.

Safe evidence and incident interpretation

Collect the version output, CSF configuration, current administrator list and relevant authentication/configuration logs before changes. A matching version plus enabled CSF is evidence of exposure requiring remediation, not proof of compromise. CISA’s KEV designation is evidence that exploitation has occurred in the wild, not attribution or a compromise finding for your environment. Escalate suspicious new administrators, unexplained configuration changes or anomalous management activity through the incident-response process; preserve evidence before resetting accounts or rebuilding.

Timeline

• 11 February 2025: CVE-2025-24472 published in the CVE/NVD record.
• 18 March 2025: CISA added it to KEV; CISA records active exploitation and known ransomware-campaign use.
• 4 November 2026: this article reviewed against Fortinet, NVD and CISA sources.

Change log

• 2026-11-04 — Revision 1: Initial publication; version ranges, fixed releases and KEV status reviewed against the cited primary and authoritative records.

References

1. Fortinet PSIRT, FG-IR-24-535.
2. NVD, CVE-2025-24472.
3. CISA, Known Exploited Vulnerabilities catalogue entry.
4. FIRST, EPSS.