InfoSecBulletin Cybersecurity for mankind
CISA has issued a critical alert about a critical vulnerability in Fortinet’s FortiOS and FortiProxy systems. CVE-2025-24472, an authentication bypass vulnerability, has been added to CISA’s Known Exploited Vulnerabilities catalog.
Fortinet FortiOS Authentication Bypass Vulnerability:
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA
CVE-2025-29824
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day
Hacker exploited Samsung MagicINFO 9 Server RCE flaw
CISA adds Langflow flaw to its KEV catalog
Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers
UAP hosted “UAP Cyber Siege 2025”, A national level cybersecurity competition
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests, which carries a CVSS score of 8.1.
The vulnerability affects FortiOS versions 7.0.0 to 7.0.16, FortiProxy 7.0.0 to 7.0.19, and FortiProxy 7.2.0 to 7.2.12.
Security experts caution that exploitation could give attackers full administrative access to systems, allowing them to create fake admin accounts, alter firewall policies, and reach SSL VPNs to access internal networks.
Mitigations:
CISA is directing organizations to “apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable”.
Fortinet has issued patches for vulnerabilities in FortiOS 7.0.17 and higher, as well as FortiProxy 7.0.20/7.2.13 and above.
The KEV catalog, managed by CISA, is a reliable source of known vulnerabilities actively exploited. CISA urges all organizations to prioritize fixing these Organizations should use the KEV catalog to prioritize their vulnerability management, as it is vital for effective external attack surface management and reducing compromise risks.
