FortiOS and FortiProxy Authentication Bypass (CVE-2024-55591)

Historical catalog analysis: CISA added this entry on January 14, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2024-55591 is an authentication bypass vulnerability (CWE-288) affecting Fortinet FortiOS and FortiProxy. The flaw resides in the Node.js websocket module, where crafted requests can allow an unauthenticated remote attacker to bypass security controls and gain super-admin privileges.

Exposure and applicability

This vulnerability applies to organizations deploying FortiOS or FortiProxy. Because it allows for remote, unauthenticated access to the highest level of administrative privilege, assets exposed to the public internet are at higher risk. The source indicates that this vulnerability has been observed in use by known ransomware campaigns.

Potential breach-prevention strategy

The reported entry path is via crafted requests sent to the Node.js websocket module; however, the specific nature of these requests and the exact sequence required for exploitation remain unknown based on available data.

Our analysis suggests that a similar breach could have been mitigated through the following prioritized actions:

1. Restrict Administrative Interface Access: Limit access to management interfaces to trusted internal networks or secure VPNs. This addresses the hypothetical scenario of an attacker reaching the websocket module from the public internet. Responsible Role: Network Security Engineer. Verification: Review firewall ACLs and interface configurations to ensure no public-facing administrative access.
2. Implement Strict Egress Filtering: Restrict outbound traffic from management appliances to only known, required update servers. This is intended to limit damage by hindering an attacker’s ability to establish command-and-control (C2) after initial access. Responsible Role: Infrastructure Architect. Verification: Audit egress logs for unauthorized connection attempts.
3. Deploy Behavioral Monitoring for Admin Accounts: Establish alerts for anomalous super-admin activity, such as unexpected configuration changes or logins from unusual locations. This is a detection control to improve recovery time. Responsible Role: SOC Analyst. Verification: Trigger a simulated administrative change and verify the alert fires in the SIEM.

Remediation priorities

Priority should be given to internet-facing FortiOS and FortiProxy instances due to the reported ransomware campaign usage. The primary corrective action is to apply mitigations as specified in vendor advisory FG-IR-24-535. If mitigations are unavailable for a specific deployment, the source recommends discontinuing use of the product.

How to validate remediation

Verification must go beyond a simple version check. Defenders should follow the specific validation steps provided in the vendor’s PSIRT advisory to ensure the fix is active and functioning as intended. A successful mitigation is evidenced by the inability of an unauthenticated request to reach the administrative functions via the websocket module.

Limits and open questions

Residual risk remains if management interfaces are left exposed despite patching, as other undiscovered bypasses may exist. It remains unclear which specific versions of FortiOS and FortiProxy are affected beyond the general product lines mentioned. Furthermore, while mitigations reduce likelihood, they do not guarantee total prevention against all future variations of authentication bypass attempts.

Source and editorial note

CVE-2024-55591: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability · Source date: January 14, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: January 17, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 28, 2026 at 00:15 UTC.

Request a Vulnerability Assessment