A high-severity authentication bypass vulnerability (CVE‑2024‑26009, CVSS: 7.9) has been discovered in multiple Fortinet products, including FortiOS, FortiProxy, and FortiPAM. This flaw enables unauthenticated attackers to seize complete administrative control over managed devices via compromised FGFM (FortiGate-to-FortiManager) communication paths—a worrying escalation of privilege potential.
What Is CVE‑2024‑26009?
Affected Products: FortiOS, FortiProxy, and FortiPAM.
Component: FGFM (FortiGate-to-FortiManager) protocol.
Nature of the Flaw: Attackers craft malicious FGFM requests to bypass authentication entirely, granting them full administrative control over targeted devices .
Risk Factors
Affected Products
FortiOS 6.0–6.4.15, FortiProxy 7.0–7.4.2, FortiPAM 1.0–1.2, FortiSwitchManager 7.0–7.2.3
Impact
Execute unauthorized code or commands, full administrative control
Exploit Prerequisites
Device managed by FortiManager + Knowledge of FortiManager’s serial number
CVSS 3.1 Score
7.9 (High Severity)
Mitigations
Why It Matters
Complete Control: Unlike mere access to limited features, this vulnerability grants full administrative rights—allowing attackers to reconfigure devices, disrupt network functionality, or pivot deeper into managed infrastructures.
Broad Exposure: FortiManager is widely used for centralized management across numerous Fortinet deployments, amplifying potential impact.
High Severity: While not reaching the highest CVSS band, a 7.9 score still signifies a serious threat that demands timely action.
Timeline & Related Threats
While CVE‑2024‑26009 is newly spotlighted, it joins a concerning history of authentication bypass vulnerabilities in Fortinet products:
CVE‑2024‑55591: A critical zero-day vulnerability (CVSS ~9.6) that allowed super-admin access via the Node.js WebSocket module. Actively exploited in the wild since mid‑November 2024, impacting FortiOS 7.0.0–7.0.16 and FortiProxy 7.0.0–7.0.19 & 7.2.0–7.2.12 .
CVE‑2025‑24472: A follow‑on authentication bypass via CSF proxy requests, actively exploited and added to CISA’s KEV catalog, with Fortinet urging immediate patching of affected versions .
CVE‑2025‑22252: A vulnerability in TACACS+ ASCII‑authentication configurations allowing full device control, prompting urgent remediation .
This pattern suggests persistent challenges in authentication mechanisms, particularly around alternate paths or management protocols.
Recommended Actions
Patch Immediately: Fortinet likely provides updates for vulnerable versions—prioritize patching FortiOS, FortiProxy, and FortiPAM deployments tied to FortiManager management.
Harden FGFM Communications:
Limit FortiManager access to trusted IPs only.
Use encrypted, authenticated channels (e.g., VPN or IPsec) for management traffic.
Audit and Monitor:
Review logs for suspicious FGFM activity or unexplained configuration changes.
Watch for newly added admin accounts or changes in administrative policies.
Defense in Depth:
Segment management infrastructure from general network access.
Ensure least‑privilege settings for service accounts and interfaces.
Conclusion
CVE‑2024‑26009 highlights a dangerous escalation—the ability for unauthenticated attackers to fully compromise Fortinet-managed devices via a central management vector. In light of related exploits, such as CVE‑2024‑55591 and CVE‑2025‑24472, organizations must reassess their patching cadence, network segmentation, and oversight of authentication pathways.
