FortiOS/FortiProxy Admin API WebSocket Auth Bypass Exploit Attempt (CVE-2024-55591/CVE-2025-24472)

Duo Tech@duotech

•updated Aug 10, 2026•2•0•8

Network signature for the specific WebSocket/admin-API request sequence used to exploit the FortiOS/FortiProxy authentication-bypass vulnerabilities CVE-2024-55591 and CVE-2025-24472, as leveraged by Gunra ransomware affiliates for initial access.