CVE-2025-24472

This bug is like a door that should require a key (login), but in some setups a clever attacker can slip through an alternate route and end up with the highest privileges. If your Fortinet setup is exposed and configured in the vulnerable way, that could let attackers take control of the device and then block access or steal data.

This matters if you use Fortinet fortios or fortiproxy and you’re running one of the affected version ranges (FortiOS 7.0.0–7.0.16, FortiProxy 7.2.0–7.2.12, or FortiProxy 7.0.0–7.0.19). Real-world attackers have used this issue in ransomware campaigns, so it’s not just theoretical. It’s mainly a risk when the attacker can reach the relevant interfaces and the vulnerable “alternate path/channel” behavior is enabled in your environment (for example, the Security Fabric configuration described for this issue).

This is RED because the issue is confirmed in real-world ransomware activity and is listed in CISA’s Known Exploited Vulnerabilities catalog. Attackers are actively using it to bypass authentication and obtain very high privileges, which can quickly lead to full compromise and disruption.