On January 14, 2025, Fortinet disclosed a new critical (CVSS 9.8) authentication bypass vulnerability affecting FortiOS and FortiProxy. CVE-2024-55591 allows unauthenticated remote attackers to target the Node.js WebSocket module of the administrative interface and potentially gain super-admin privileges. CyCognito is helping customers identify assets vulnerable to CVE-2024-55591.
Read more about Emerging Threat: Fortinet CVE-2024-55591CVE-2024-47575 (FortiJump) is a missing authentication vulnerability affecting critical functions in FortiManager and FortiManager Cloud versions. Approximately 60,000 assets are externally exposed worldwide. All CyCognito customers have access to an in-platform emerging threat announcement and methods to identify potentially vulnerable assets.
Read more about Emerging Threat: FortiJump (CVE-2024-47575)CVE-2024-23113 is a critical (9.8) Fortinet remote code execution (RCE) vulnerability affecting a variety of Fortinet products and versions. CyCognito is investigating active tests for CVE-2024-9463. Users can check if their assets are potentially vulnerable using provided filters in the CyCognito platform.
Read more about Emerging Security Issue: Fortinet FortiOS CVE-2024-23113