CVE-2025-24472

What it actually does

CVE-2025-24472 is an authentication-bypass flaw in Fortinet FortiOS and FortiProxy Security Fabric / CSF proxy handling. When Security Fabric is enabled, a remote unauthenticated attacker who knows the serial numbers of relevant upstream and downstream devices can craft CSF proxy requests that are accepted as trusted fabric traffic. Successful exploitation can grant super-admin privileges on the downstream device, allowing full administrative control of firewall or proxy configuration, users, VPN settings, policies, routing, logging, and related security controls.

Why it matters to the business

Compromise of a FortiOS firewall or FortiProxy appliance can give an attacker control over a critical network security boundary. This can lead to unauthorized remote access, traffic interception or redirection, disabling of security controls, creation of persistent administrator or VPN accounts, exposure of sensitive configuration data, and lateral movement into internal networks. The vulnerability is listed in CISA KEV, has active in-the-wild exploitation, is flagged as used in ransomware campaigns, and had a CISA remediation deadline of 2025-04-08, so unpatched internet-reachable or fabric-enabled devices should be treated as high-priority exposure even though the EPSS score is modest.

How an attack unfolds

An attacker first identifies FortiOS or FortiProxy devices with Security Fabric enabled and determines whether CSF-related services are reachable from their position on the network. The attacker then obtains or guesses the required upstream and downstream device serial numbers, potentially from exposed management interfaces, leaked configurations, prior compromise, support bundles, asset inventories, or reconnaissance of related Fortinet infrastructure. Using those values, the attacker sends crafted CSF proxy requests that abuse the alternate trusted Security Fabric path. If accepted, the requests bypass normal authentication and allow the attacker to operate with super-admin authority on the downstream device. After gaining administrative control, the attacker may add administrator accounts, create VPN users, alter firewall and proxy policy, disable or reduce logging, export device configuration, establish persistence, and use the device as a foothold for internal reconnaissance, data theft, or ransomware deployment.

How to fix it

Upgrade affected Fortinet products to fixed or later supported releases. Based on the affected ranges, FortiOS 7.0.0 through 7.0.16 should be upgraded to FortiOS 7.0.17 or later, and FortiProxy 7.2.0 through 7.2.12 should be upgraded to FortiProxy 7.2.13 or later; FortiProxy 7.0.0 through 7.0.19 should be upgraded to FortiProxy 7.0.20 or later. If an upgrade cannot be completed immediately, disable Security Fabric where it is not required, restrict CSF/Security Fabric connectivity to explicitly trusted Fortinet devices and management networks, block external access to management and fabric-related services, and ensure administrative interfaces are not exposed to the internet. Review and remove unauthorized administrator, API, automation, and VPN accounts; rotate administrative credentials and API tokens; back up and compare configurations; and consider rebuilding appliances where exploitation is suspected.

How to confirm the fix worked

Confirm product and build versions on all FortiOS and FortiProxy appliances and verify they are at or above the fixed releases. Validate whether Security Fabric is enabled and whether CSF-related services are reachable from untrusted networks. Review firewall rules, local-in policies, trusted hosts, management interface exposure, and any upstream/downstream Security Fabric relationships. After patching or mitigation, repeat external and internal exposure checks to ensure management and fabric services are not reachable except from approved sources. Validate that no unexpected super-admin accounts, API users, VPN users, automation stitches, policy changes, static routes, or logging changes were introduced before remediation.

Typical attack path

1. Identify FortiOS or FortiProxy appliances running affected versions with Security Fabric enabled.
2. Determine whether the CSF/Security Fabric management path is reachable from the attacker’s network location.
3. Obtain the upstream and downstream Fortinet device serial numbers through reconnaissance, exposed configuration data, previous compromise, or leaked support artifacts.
4. Send crafted CSF proxy requests that present as trusted Security Fabric traffic.
5. Bypass authentication and gain super-admin privileges on the downstream device.
6. Create or modify administrator, API, or VPN access for persistence.
7. Export configuration, inspect policies and routes, and map reachable internal networks.
8. Modify security controls, logging, or access policies to support further intrusion, data theft, or ransomware activity.

How to detect it

Investigate FortiOS and FortiProxy event, system, administrative, VPN, configuration-change, and traffic logs for suspicious Security Fabric or CSF activity, especially requests from unexpected source IPs or devices that do not match approved upstream or downstream fabric members. Look for creation of new super-admin accounts, privilege changes, unexpected administrator logins, new API users or tokens, new VPN users, modified firewall or proxy policies, disabled logging, altered local-in policies, and configuration exports after unusual CSF requests. Correlate device logs with network telemetry for connections to CSF/Security Fabric services from untrusted networks. Review configuration backups for unauthorized changes and compare trusted host settings, admin profiles, routing, VPN portals, and automation stitches. Because exploitation can result in valid super-admin activity, do not rely only on failed-login events; prioritize anomalous successful administrative actions, first-seen admin accounts, and changes occurring outside maintenance windows. If ransomware activity is suspected, also examine downstream authentication, VPN, endpoint, and file-share telemetry for lateral movement following the Fortinet administrative event.

• CSF
• Security Fabric
• csf
• super_admin
• cfgpath=system.admin
• system.admin
• Add administrator
• Edit administrator
• Delete administrator
• Administrator login successful
• admin login successful
• Configuration changed
• Configuration backup
• log setting
• set status disable
• set trustedhost
• set accprofile super_admin
• set accprofile "super_admin"
• set remote-auth enable
• set two-factor disable
• set api-key
• api-user
• vpn.ssl
• ssl-vpn
• user local
• set type password
• set member
• local-in-policy
• TCP/8013

What your security team should do

• Immediately inventory FortiOS and FortiProxy appliances and prioritize any affected, internet-reachable, or Security-Fabric-enabled systems.
• Patch to FortiOS 7.0.17 or later, FortiProxy 7.2.13 or later, or FortiProxy 7.0.20 or later as applicable.
• Treat unpatched systems as urgent because the vulnerability is in CISA KEV, is actively exploited in the wild, and is associated with ransomware activity.
• If patching is delayed, disable Security Fabric where possible and restrict CSF/Security Fabric traffic to known trusted Fortinet devices only.
• Audit all administrator, API, automation, and VPN accounts for unauthorized additions or privilege changes.
• Export and compare current configurations against known-good backups for unexpected policy, routing, logging, or remote-access changes.
• Rotate administrative credentials and revoke or regenerate API tokens after patching, especially if suspicious activity is found.
• Hunt historical logs for CSF activity, administrator creation, configuration changes, and log-tampering events around the likely exposure window.
• Consider incident response escalation and appliance rebuild if evidence indicates super-admin compromise.