Exploitation evidence
Known exploited · CISA KEV listed
Added 2025-03-18. Ransomware campaign use: Known.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date: 2025-04-08. This is the catalog’s deadline, not an assessment of your organization’s exposure.
KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗Reported products and versions
Fortinet / FortiOS
Default status: unaffected
- affected: 7.0.0 to ≤ 7.0.16 (semver)
Fortinet / FortiProxy
Default status: unaffected
- affected: 7.2.0 to ≤ 7.2.12 (semver)
- affected: 7.0.0 to ≤ 7.0.19 (semver)
Fixes and workarounds
Upgrade to FortiOS version 7.0.17 or above Upgrade to FortiProxy version 7.2.13 or above Upgrade to FortiProxy version 7.0.20 or above
Sources and related reporting
Observed change timeline
History begins when Egret first downloads each source. It is not the complete upstream CVE history.
12 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-12",
"epss": 0.07235,
"percentile": 0.94413
}10 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-10",
"epss": 0.07235,
"percentile": 0.94378
}09 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-09",
"epss": 0.07235,
"percentile": 0.94371
}08 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-08",
"epss": 0.07235,
"percentile": 0.94368
}07 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-07",
"epss": 0.07235,
"percentile": 0.94364
}06 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-06",
"epss": 0.07235,
"percentile": 0.94355
}06 Nov 2026, 06:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-05",
"epss": 0.07235,
"percentile": 0.94351
}04 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-04",
"epss": 0.07235,
"percentile": 0.94347
}03 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-03",
"epss": 0.07235,
"percentile": 0.94337
}03 Nov 2026, 18:20 Jerusalem · CVE Program record changed
Stored CNA snapshot at this observation.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-24472",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-03-18",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24472"
},
"type": "kev"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T03:56:00.893Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24472"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-03-18T00:00:00.000Z",
"value": "CVE-2025-24472 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:o:fortinet:fortios:7.0.16:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.15:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.14:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.13:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.12:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.11:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.10:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.9:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.8:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.7:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.6:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.5:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:o:fortinet:fortios:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiOS",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "7.0.16",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
},
{
"cpes": [
"cpe:2.3:a:fortinet:fortiproxy:7.2.12:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.11:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.10:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.19:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.18:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.17:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.16:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.15:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.14:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.13:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.12:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.11:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.10:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.9:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.8:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.7:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.5:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:fortinet:fortiproxy:7.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiProxy",
"vendor": "Fortinet",
"versions": [
{
"lessThanOrEqual": "7.2.12",
"status": "affected",
"version": "7.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.19",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.2.0 through 7.2.12, 7.0.0 through 7.0.19 may allow a remote unauthenticated attacker with prior knowledge of upstream and downstream devices serial numbers to gain super-admin privileges on the downstream device, if the Security Fabric is enabled, via crafted CSF proxy requests."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "Execute unauthorized code or commands",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-08T12:55:22.679Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-535",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-535"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiOS version 7.0.17 or above\nUpgrade to FortiProxy version 7.2.13 or above\nUpgrade to FortiProxy version 7.0.20 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2025-24472",
"datePublished": "2025-02-11T16:50:42.207Z",
"dateReserved": "2025-01-21T20:48:07.886Z",
"dateUpdated": "2026-08-05T03:56:00.893Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}03 Nov 2026, 02:22 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-02",
"epss": 0.07235,
"percentile": 0.94329
}03 Nov 2026, 02:22 Jerusalem · CISA KEV status changed
Stored KEV snapshot at this observation.
{
"cveID": "CVE-2025-24472",
"cwes": [
"CWE-288"
],
"dateAdded": "2025-03-18",
"dueDate": "2025-04-08",
"forensicTriage": "No",
"knownRansomwareCampaignUse": "Known",
"notes": "https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24472",
"product": "FortiOS and FortiProxy",
"requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"shortDescription": " Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.",
"vendorProject": "Fortinet",
"vulnerabilityName": "Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability"
}