Multiple Fortinet products vulnerable to remote code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple vulnerabilities in Fortinet management and security products allow remote code execution; CVE-2024-55591 was exploited in the wild in January 2025.
Fortinet has disclosed multiple vulnerabilities across its product portfolio, with the most critical affecting FortiManager, FortiAnalyzer, FortiSandbox, FortiOS, FortiProxy, FortiSwitchManager, and FortiPAM. The primary threats are authentication bypass vulnerabilities (CVE-2025-24472, CVE-2024-55591) that allow remote attackers to gain super-admin privileges via crafted requests to Node, and a stack-based buffer overflow in FortiOS CAPWAP control (CVE-2024-35279) that permits unauthenticated remote code execution through specially crafted UDP packets if fabric service is running on an exposed interface. CVE-2024-55591 was confirmed exploited in the wild during January 2025 but is no longer being actively exploited as of the February 12 update.
Additional lower-severity vulnerabilities include format string injection, path traversal, OS command injection, cross-site scripting, and sensitive information exposure flaws across multiple Fortinet products. Successful exploitation could allow attackers to execute arbitrary code in the context of the affected service account, with impact depending on service account privileges—administrative service accounts represent higher risk. The advisory affects multiple product versions ranging from legacy 6.2 releases through recent 7.6 versions.
Defenders should prioritize patching FortiOS and FortiProxy authentication bypass vulnerabilities and FortiOS CAPWAP buffer overflow issues immediately, particularly for internet-facing instances. Implementing network segmentation, least-privilege service account configurations, and vulnerability scanning is critical given the breadth of affected products and the confirmed prior exploitation.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-fortinet-products-could-allow-for-remote-code-execution_2025-017
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,571 reports from 145 sources, 595 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs