CRITICAL Actively exploited Used in ransomware CWE-288
CVE-2024-55591
Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability
Fortinet·FortiOS and FortiProxy
9.6/ 10
CVSS 3.1
Critical severity
94%
EPSS exploit odds
Chance of exploitation in the next 30 days
Higher than 99.9% of all CVEs
Listed
CISA KEV catalog
- Added
- Jan 14, 2025
- Fix due
- Jan 21, 2025
- Ransomware
- Known use
Timeline
- Published
- Jan 14, 2025
- Updated
- Aug 5, 2026
- First covered
- Aug 12, 2026
- Latest story
- 3 months ago
Summary
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
CWE-288Execute unauthorized code or commands
Attack profile
Attack vectorNetwork
ComplexityLow
PrivilegesNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:CCISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected products
- Fortinet FortiOS7.0.0 to 7.0.16
- Fortinet FortiProxy7.2.0 to 7.2.127.0.0 to 7.0.19