Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability (CVE-2024-55591)

What is affected, what to do

An authentication bypass vulnerability in Fortinet FortiOS and FortiProxy allows an unauthenticated, remote attacker to gain super-admin privileges through crafted requests to the Node.js websocket module. This vulnerability is actively exploited in ransomware campaigns since 2024. Affected versions include FortiOS 7.0.0 to 7.0.17 and FortiProxy 7.0.0 to 7.0.20, as well as 7.2.0 to 7.2.13. It is critical to update to the latest versions to mitigate this vulnerability. The flaw is listed in the CISA KEV catalog and has a high exploit maturity.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update fortiproxy to version 7.0.20. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Fortinet FortiOS lte 7.0.0..7.0.16
• Fortinet FortiProxy lte 7.2.0..7.2.12
• Fortinet FortiProxy lte 7.0.0..7.0.19

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Establish exposure: Inventory every FortiGate (FortiOS 7.0.x) and FortiProxy (7.0.x, 7.2.x) instance. Check whether the HTTP/HTTPS admin interface is reachable from the internet or from untrusted segments: run an external scan of port 443 or the configured admin-sport, and review show system interface for allowaccess https/http.
   • Lock down management access now: Remove https and http from allowaccess on all WAN-facing interfaces. Where that is not operationally possible, restrict access to dedicated admin source networks with a local-in-policy. Do this before the patch rollout, because it closes the attack path immediately.
   • Patch: Upgrade FortiOS to 7.0.17 or later. Upgrade FortiProxy to 7.0.20 or later or 7.2.13 or later. Check the Fortinet PSIRT advisory for exact builds and upgrade paths. Back up the running config before upgrading, because you will need it as forensic evidence.
   • Run a compromise assessment before patching: Upgrading does not remove persistence an attacker has already set up. Look for:
     • unknown admin accounts (config system admin),
     • new local users and changes to SSL-VPN user groups,
     • altered firewall policies and new address objects. Diff the current config against the last known-good backup.
   • If you find indicators: Treat the device as fully compromised.
     • Rotate all admin passwords.
     • Renew LDAP/RADIUS bind accounts, IPsec PSKs, SSL-VPN credentials and device certificates.
     • Rebuild the config from a clean baseline rather than carrying the compromised config forward.
     • Hunt for lateral movement originating from VPN sessions.
   • Check reporting obligations: A confirmed compromise at a NIS2/KRITIS entity starts the 24 h early-warning clock (BSI or your national CSIRT). Bring in IR leadership and legal early.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Expose the management plane only on a dedicated management interface or management VDOM/VRF. Allow access only from an admin jump-host network, never from the internet.
   • Local-in policy (FortiOS CLI): First add an allow rule for the admin source address object on HTTPS/HTTP, then a catch-all deny:
     • config firewall local-in-policy → set intf "wan1" → set srcaddr "all" → set dstaddr "all" → set service "HTTPS" "HTTP" → set schedule "always" → set action deny
     • The allow rule must sit above the deny. Verify the result with an external test.
   • Upstream IPS/WAF: Where an upstream inspection point can see decrypted TLS, block and alert on requests carrying Upgrade: websocket to /ws/ paths on the admin UI from non-allowlisted sources. Without TLS inspection, source-IP filtering is your only control here.
   • IAM / least privilege: Keep super_admin profiles to a minimum, and enforce MFA and trusted hosts on admin accounts. Note that trusted hosts alone are not a reliable defence against this authentication bypass. Treat them as a complement to network-level blocking, not a replacement.
   • Configuration integrity monitoring: Ship regular config backups off-box and alert on any change to system.admin, user.local or user.group, for example via FortiManager revision diffs or a scripted diff.
3. 03

   Runbook step 3

   Detection rules

   • FortiGate event log (admin login via jsconsole): Successful logins with ui="jsconsole" / method="jsconsole" are a key indicator, particularly with odd srcip/dstip pairs such as loopback addresses.
     • SPL: index=fortigate logdesc="Admin login successful" ui="jsconsole"
   • New admin or user accounts: Detect logdesc="Object attribute configured" with cfgpath in system.admin, user.local or user.group and action="Add", especially where usernames look random.
     • KQL: CommonSecurityLog | where DeviceVendor == "Fortinet" and AdditionalExtensions has_any ("system.admin","user.local","user.group") and Activity has "configured"
   • Post-exploitation SSL-VPN abuse: Review VPN logins from accounts created in the last 30 days. Also check sessions from unusual geolocations and tunnels that immediately generate internal RDP/SMB traffic (Zeek conn.log: VPN pool → internal ports 445/3389).
   • Out-of-window policy changes: Detect changes to firewall.policy and firewall.address that have no matching change ticket. As a Sigma shape: logsource: fortinet/fortigate, selection: subtype=system, cfgpath|startswith: firewall., plus a time-window filter.
   • Network telemetry: Use NetFlow/Zeek to watch inbound HTTPS from the internet to the management IP. Once lockdown is in place, any non-allowlisted external source indicates scanning or a control that is not working.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.

Source: CSA/SingCERT, NCSC NZ (CC BY 4.0), pwn.watch, CISA KEV Catalog, cvelistv5, NVD (NIST), CVE.org (MITRE)

Vendors and products

• Fortinet Fortinet FortiOS
• Fortinet Fortinet FortiProxy

Weakness classes (CWE)

• CWE-288Authentication Bypass Using an Alternate Path or Channel

  Base

  The product requires authentication, but the product has an alternate path or channel that does not require authentication.

  Entry at MITRE CWE-288

References & sources

• fortiguard.fortinet.compsirt/FG-IR-24-535pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-55591government-resource
• cert.atCERT.at: Ransomware-Gruppen nutzen weiterhin kritische Fortinet-Schwachstellen - Warnung vor gepatchten, aber bereits kompromittierten Gerätencert-at
• cert.cyber.gouv.frANSSI / CERT-FR: CERTFR-2025-ALE-002 – [MàJ] Vulnérabilité dans les produits Fortinet (clôturée 2025-05-07)cert-fr
• pwn.watchpwn.watch: Fortinet FortiOS and FortiProxy: FortiOS and FortiProxy Authentication Bypass Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2024-55591pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Linked advisories

• September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in WindowsCSO Online09.09.2026