InfoSecBulletin Cybersecurity for mankind
CISA has issued a critical alert about a critical vulnerability in Fortinet’s FortiOS and FortiProxy systems. CVE-2025-24472, an authentication bypass vulnerability, has been added to CISA’s Known Exploited Vulnerabilities catalog.
Fortinet FortiOS Authentication Bypass Vulnerability:
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests, which carries a CVSS score of 8.1.
The vulnerability affects FortiOS versions 7.0.0 to 7.0.16, FortiProxy 7.0.0 to 7.0.19, and FortiProxy 7.2.0 to 7.2.12.
Security experts caution that exploitation could give attackers full administrative access to systems, allowing them to create fake admin accounts, alter firewall policies, and reach SSL VPNs to access internal networks.
Mitigations:
CISA is directing organizations to “apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable”.
Fortinet has issued patches for vulnerabilities in FortiOS 7.0.17 and higher, as well as FortiProxy 7.0.20/7.2.13 and above.
The KEV catalog, managed by CISA, is a reliable source of known vulnerabilities actively exploited. CISA urges all organizations to prioritize fixing these Organizations should use the KEV catalog to prioritize their vulnerability management, as it is vital for effective external attack surface management and reducing compromise risks.
