CVE-2024-55591

The vulnerability in question pertains to an authentication bypass issue within specific versions of FortiOS and FortiProxy, which allows remote attackers to exploit crafted requests directed at the Node.js websocket module. This flaw arises from improper validation of authentication credentials, enabling unauthorized access to super-admin privileges. The affected versions span FortiOS 7.0.0 through 7.0.16 and FortiProxy 7.0.0 through 7.0.19, as well as 7.2.0 through 7.2.12. The exploitation of this vulnerability can occur without requiring physical access to the network, making it particularly concerning for organizations relying on these products for secure network operations.

Attack vectors for this vulnerability are primarily remote, leveraging crafted requests that exploit the underlying websocket module. An attacker could initiate a session with the vulnerable system, bypassing standard authentication mechanisms. By sending specifically formatted messages, the attacker can manipulate the system into granting super-admin privileges. This exploitation could be executed from anywhere on the internet, provided the attacker can reach the vulnerable service, significantly broadening the attack surface. Scenarios may include targeted attacks against organizations that use Fortinet products for web filtering, VPN services, or other critical network functions, where gaining super-admin access could lead to further compromise.

The real-world impact of this vulnerability is profound, particularly given its high CVSS score of 9.8, indicating critical severity. Organizations that utilize the affected versions of FortiOS and FortiProxy are at significant risk of unauthorized access, which could lead to data breaches, service disruptions, or the deployment of malicious payloads. The potential for a remote attacker to gain super-admin privileges means that they could manipulate configurations, exfiltrate sensitive data, or even pivot to other systems within the network. The business risk associated with such an incident includes not only financial losses but also reputational damage, regulatory penalties, and the costs associated with incident response and recovery.

To detect and mitigate this vulnerability, organizations should prioritize immediate updates to the latest patched versions of FortiOS and FortiProxy. Regularly applying security patches is crucial in maintaining the integrity of network security devices. Additionally, implementing robust monitoring solutions that can detect anomalous activity related to authentication processes is essential. Organizations should also consider employing network segmentation to limit the exposure of critical systems to untrusted networks. Intrusion detection systems (IDS) can be configured to alert administrators of suspicious websocket traffic patterns, providing an additional layer of defense.

In conclusion, the authentication bypass vulnerability in FortiOS and FortiProxy represents a significant threat to organizations utilizing these products. The ability for remote attackers to gain super-admin access through crafted requests underscores the need for vigilant security practices, including timely updates, continuous monitoring, and proactive incident response planning. By understanding the technical details, potential attack vectors, and real-world implications of this vulnerability, organizations can better prepare themselves to defend against such critical threats in the evolving landscape of cybersecurity.

CSURFACE threat intelligence has detected a slight increase in exploitation attempts targeting CVE-2024-55591, reflecting a modest uptick in attacker activity leveraging this critical authentication bypass vulnerability. Although the EPSS score remains stable at a very high level, the observed rise in telemetry signals a growing interest among threat actors, including those linked to ransomware campaigns such as Mora_001. The persistence of multiple publicly available proof-of-concept exploits continues to lower the barrier for adversaries to weaponize this vulnerability, sustaining its attractiveness for opportunistic and targeted intrusions. This evolving exploitation landscape underscores an elevated risk profile for organizations running affected FortiOS and FortiProxy versions, as the vulnerability’s exploitation could facilitate unauthorized super-admin access, potentially enabling ransomware deployment or other malicious operations. Consequently, the threat level remains critical, with the recent activity indicating that exploitation attempts are becoming more frequent, warranting heightened vigilance in monitoring and detection efforts.

Update 2 — May 20, 2026

Recent updates to CVE-2024-55591 reveal a slight downward adjustment in its CVSS score from 9.8 to 9.6, accompanied by a marginal decrease in the Exploit Prediction Scoring System (EPSS) value. While these numerical changes suggest a modest recalibration of the vulnerability’s assessed severity and exploit likelihood, CSURFACE threat intelligence continues to detect sustained exploitation efforts, particularly linked to ransomware campaigns attributed to the Mora_001 group. The inclusion of this vulnerability in the Known Exploited Vulnerabilities (KEV) catalog with a defined remediation deadline further underscores its operational relevance. Additionally, the emergence of multiple new proof-of-concept exploits, including comprehensive Python-based tools, signals that adversaries are actively refining their capabilities to leverage this authentication bypass. For defenders, these developments emphasize the persistent and evolving threat posed by this vulnerability despite the slight score adjustments. The risk environment remains critical, as the vulnerability’s exploitation continues to facilitate unauthorized super-admin access, which can serve as a gateway for ransomware deployment and other malicious activities. Therefore, the threat level should be maintained at a critical posture, with continued emphasis on detection and response to exploitation attempts.

Update 3 — June 07, 2026

CSURFACE threat intelligence has identified a marked escalation in exploitation attempts targeting CVE-2024-55591, accompanied by a refined upward adjustment in its CVSS score to 9.8, reflecting an increased consensus on the vulnerability’s criticality. Our telemetry indicates a sustained rise in adversary activity leveraging this authentication bypass, underscoring its continued attractiveness as a vector for unauthorized super-admin access. Notably, the vulnerability’s inclusion in the KEV catalog with a ransomware use designation highlights its growing exploitation in ransomware campaigns, particularly by groups such as Mora_001. Although the EPSS score shows a marginal increase, the overall risk environment remains highly volatile given the persistent detection of exploitation attempts and the availability of multiple proof-of-concept exploits circulating publicly. This evolution signifies that threat actors are intensifying efforts to weaponize this vulnerability, reinforcing the necessity for defenders to maintain heightened vigilance. Consequently, the threat level associated with CVE-2024-55591 remains critical, with an elevated potential for impactful breaches that could facilitate ransomware deployment and broader network compromise.

Update 4 — June 15, 2026

CSURFACE threat intelligence has detected a notable surge in exploitation attempts targeting CVE-2024-55591, accompanied by a measurable increase in the EPSS score, reflecting growing attacker interest and capability. This uptick coincides with the recent inclusion of this vulnerability in the Known Exploited Vulnerabilities (KEV) catalog, which underscores its elevated priority within the threat landscape. Our telemetry indicates that ransomware groups linked to Mora_001 continue to leverage this authentication bypass flaw, reinforcing its role as a vector for high-impact ransomware campaigns. Additionally, the proliferation of multiple publicly available proof-of-concept exploits has lowered the barrier to entry for adversaries, facilitating broader exploitation attempts. Collectively, these developments signify a heightened operational tempo among threat actors, increasing the likelihood of successful intrusions and subsequent privilege escalations. Consequently, the threat level associated with CVE-2024-55591 has intensified, warranting sustained attention as it remains a critical risk for organizations deploying affected Fortinet products.

Update 5 — June 22, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2024-55591, evidenced by a significant uptick in telemetry signals. This increase coincides with the vulnerability’s recent inclusion in the Known Exploited Vulnerabilities (KEV) catalog, underscoring its growing appeal to threat actors. Notably, ransomware groups linked to the Mora_001 cluster continue to leverage this authentication bypass flaw, reinforcing its role as a critical enabler for high-impact intrusion campaigns. Although the Exploit Prediction Scoring System (EPSS) score remains near maximal, the sustained upward trend in exploitation activity signals an intensifying operational tempo. For defenders, this evolving landscape heightens the urgency of monitoring for exploitation indicators and reinforces the vulnerability’s status as a top-tier risk. The convergence of public proof-of-concept availability, KEV designation, and active ransomware exploitation collectively elevate the threat level, demanding continued vigilance across affected Fortinet environments.

Update 6 — July 09, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2024-55591, reflecting a sustained increase in adversary activity leveraging this critical authentication bypass vulnerability. Although the CVSS score was slightly adjusted downward to 9.6, this recalibration does not diminish the operational impact observed through our telemetry. The vulnerability’s inclusion in the KEV catalog and its confirmed use in ransomware campaigns, particularly by the Mora_001 group, underscore its continued strategic value to threat actors. Public availability of multiple proof-of-concept exploits has likely contributed to the broader exploitation footprint, facilitating easier weaponization and accelerating attack campaigns. Despite a stable EPSS score, the uptick in exploitation attempts signals an intensifying threat environment that demands heightened situational awareness. Consequently, the risk level remains critically high, with adversaries actively capitalizing on this vulnerability to achieve super-admin access and potentially deploy ransomware payloads, reinforcing the imperative for defenders to maintain vigilant monitoring within affected Fortinet infrastructures.