FortiOS and FortiProxy authentication bypass (CVE-2024-55591)

A remote attacker with no login can send crafted requests to the device and gain super-admin rights. Super-admin is the highest level of control over a firewall or proxy, so the attacker can change its settings and create new administrator accounts. Fortinet's later update adds that crafted requests to the CSF proxy can also trigger the flaw.

Fortinet lists FortiOS 7.0.0 to 7.0.16, FortiProxy 7.2.0 to 7.2.12 and FortiProxy 7.0.0 to 7.0.19. Fortinet says FortiOS 7.6, 7.4, 7.2 and 6.4 are not affected. The National Vulnerability Database gives the same version ranges.

Fortinet published its advisory on 14 January 2025 and noted that reports show the flaw is being exploited in the wild. CISA added CVE-2024-55591 to the Known Exploited Vulnerabilities catalog the same day, with a due date of 21 January 2025 for US federal agencies.

The catalog marks known ransomware campaign use as Known. Fortinet's advisory lists log entries that may point to an attack, such as a super-admin login through the jsconsole interface and the creation of administrator accounts with randomly generated names.

Sophos says affiliates of The Gentlemen ransomware program kept a list of FortiGate devices that were vulnerable to CVE-2024-55591. Check Point's Q1 2026 ransomware report describes a cache of about 14,700 pre-exploited FortiGate devices linked to the same group, exploited primarily through this flaw.

Our profile describes how The Gentlemen get in through FortiGate devices. Our post on The Gentlemen claiming 38 victims in one day lists patching this flaw first among the defenders' steps.