# Fortinet products vulnerable to RCE via auth bypass and hard-coded keys

Published: 2026-06-09 · Severity: high · Sectors: government-national, defense
Canonical: https://vorant.io/reports/b451b768-ef35-597a-a397-3adc6fcbaf5b/fortinet-products-vulnerable-to-rce-via-auth-bypass-and-hard-coded-keys

> Multiple Fortinet products vulnerable to remote code execution; CVE-2024-55591 actively exploited in the wild.

CIS-ISAC has published a multi-product vulnerability advisory affecting Fortinet's management, security gateway, and infrastructure products. The most critical issue is CVE-2024-55591, an authentication bypass in FortiOS and FortiProxy affecting versions 7.0.0 through 7.4.4 that allows remote attackers to gain super-admin privileges via crafted requests, and Fortinet confirms active exploitation in the wild. Additional high-severity vulnerabilities include CVE-2023-37936, a hard-coded cryptographic key in FortiSwitch permitting unauthenticated remote code execution, and CVE-2024-35277, a missing authentication flaw in FortiManager and FortiPortal allowing configuration extraction. Affected products span FortiManager, FortiAnalyzer, FortiOS, FortiProxy, FortiAP, FortiSwitch, FortiSandbox, FortiRecorder, FortiVoice, FortiWeb, and cloud variants, with vulnerable versions ranging from 6.0 to 7.6.x depending on the product. Successful exploitation permits remote code execution in the context of the affected service account; impact depends on service account privilege level.

## Mentioned in this report

- Vulnerabilities: CVE-2023-37936, CVE-2024-35277, CVE-2024-55591 (KEV)

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-remote-code-execution_2025-006

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b451b768-ef35-597a-a397-3adc6fcbaf5b/fortinet-products-vulnerable-to-rce-via-auth-bypass-and-hard-coded-keys.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup