FortiOS/FortiProxy Admin Auth Anomaly Indicative of CVE-2024-55591/CVE-2025-24472 Exploitation

Ankit Mehta@Secvyn

•updated Aug 11, 2026•6•2•9

Detects signs of exploitation against FortiOS/FortiProxy authentication bypass vulnerabilities (CVE-2024-55591 / CVE-2025-24472) consistent with Gunra ransomware activity. This rule monitors for administrative logins originating from non-management public IP addresses and identifies potential MFA bypass attempts through the reuse of identical one-time passcodes across multiple distinct accounts or sessions within a one-hour window.