FortiOS auth bypass exploited in Japan
Fortinet disclosed CVE-2024-55591, an authentication bypass in FortiOS enabling unauthenticated remote attackers to gain admin access; active exploitation observed in Japan.
Japan's IPA has issued an alert for CVE-2024-55591, a critical authentication bypass vulnerability in Fortinet's FortiOS. The flaw allows unauthenticated remote attackers to obtain administrator privileges without authentication. Fortinet has confirmed active exploitation of this vulnerability in the wild.
On May 12, 2025, IPA updated the advisory to note that attacks exploiting this vulnerability have been observed within Japan, increasing the urgency for affected organizations to apply patches immediately. Fortinet has released fixed versions and published indicators of compromise (IOCs) in their advisory to assist organizations in investigating potential breaches.
Organizations running affected FortiOS versions should prioritize upgrading to patched releases. Fortinet has also provided workarounds that can mitigate the vulnerability's impact until full patching is completed. Given the confirmed in-the-wild exploitation and geographic spread to Japan, this represents an active and expanding threat to enterprise networks.
Mentioned in this report
Detection guidance
FortiOS Admin Access via jsconsole/Node.js WebSocket Interface
Detects HTTP/websocket requests to the FortiOS jsconsole management interface, the vector used to exploit CVE-2024-55591 for unauthenticated administrative access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS Admin Access via jsconsole/Node.js WebSocket Interface
id: b00ccf9b-201c-56af-ab22-f621b0319524
status: experimental
description: 'Detects HTTP or websocket requests to the FortiOS jsconsole/Node.js
websocket management endpoint. This interface has been abused to exploit CVE-2024-55591,
an authentication bypass allowing unauthenticated attackers to obtain super-admin
privileges on FortiOS devices.
'
references:
- https://www.fortiguard.com/psirt/FG-IR-24-535
logsource:
category: webserver
product: fortios
detection:
selection:
cs-uri-stem|contains:
- /jsconsole
- /api/v2/authentication
filter_known_admin:
c-ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: selection and not filter_known_admin
falsepositives:
- Legitimate administrative use of the jsconsole feature from trusted internal management
subnets
level: high
tags:
- attack.t1190
- attack.initial_access
author: Vorant
FortiOS New Local Administrator Account Created Without Prior Authentication
Detects creation of a new local administrator account on FortiOS shortly after an unauthenticated management-interface request, consistent with post-exploitation of the CVE-2024-55591 auth bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS New Local Administrator Account Created Without Prior Authentication
id: d3109add-157d-5876-bfe0-34f01287c961
status: experimental
description: 'Detects the creation of a new local admin/super-admin account on a FortiOS
device. Attackers exploiting CVE-2024-55591 leverage the jsconsole authentication
bypass to create rogue administrator accounts for persistent access without ever
supplying valid credentials.
'
references:
- https://www.fortiguard.com/psirt/FG-IR-24-535
logsource:
category: application
product: fortios
detection:
selection:
action: user_add
admin_profile: super_admin
filter_change_ticket:
reason|contains: scheduled-maintenance
condition: selection and not filter_change_ticket
falsepositives:
- Legitimate administrator onboarding performed by IT staff and documented in change
management
level: high
tags:
- attack.t1078
- attack.persistence
- attack.privilege_escalation
author: Vorant
FortiOS Administrator Login Immediately Following Unauthenticated Management Request
Detects a successful administrative login event on FortiOS occurring immediately after an unauthenticated request to the management interface, indicating possible abuse of a bypassed authentication flow rather than a normal login sequence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FortiOS Administrator Login Immediately Following Unauthenticated Management
Request
id: 9a6d478c-4c6d-5864-b2fe-048038b8b202
status: experimental
description: 'Detects successful super-admin authentication events on FortiOS management
interfaces that occur without a preceding standard login/authentication challenge
in the logs, consistent with abuse of the CVE-2024-55591 authentication bypass to
obtain valid administrator sessions.
'
references:
- https://www.fortiguard.com/psirt/FG-IR-24-535
logsource:
category: authentication
product: fortios
detection:
selection:
action: login
admin_profile: super_admin
method: jsconsole
condition: selection
falsepositives:
- Authorized administrators using the local console/jsconsole for routine device management
level: medium
tags:
- attack.t1078
- attack.defense_evasion
- attack.initial_access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert20250115.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free