Fortinet Firewalls Actively Exploited: Critical SSO Flaw Bypasses Authentication

Critical Fortinet Flaw Escalates to Active Exploitation, Threatening Network Perimeters

Network security teams worldwide are facing an urgent patching imperative as a critical authentication bypass vulnerability in Fortinet's flagship security appliances transitions from theoretical advisory to active, in-the-wild attacks. The flaw, a severe issue in the Security Assertion Markup Language (SAML) Single Sign-On (SSO) component, allows unauthenticated remote attackers to bypass login protections entirely and gain administrative control over affected FortiGate Next-Generation Firewalls (NGFWs) and FortiProxy secure web gateways.

Tracked as CVE-2024-21762, this vulnerability has been assigned a critical severity rating due to its low attack complexity and the high-impact consequence of complete system compromise. Security researchers and Fortinet's own Product Security Incident Response Team (PSIRT) have confirmed observing active exploitation attempts against unpatched devices exposed to the internet. This development transforms the threat landscape, moving the vulnerability from a patch-when-possible item to a patch-immediately emergency for any organization using affected products.

Technical Breakdown: The SAML SSO Bypass Mechanism

The vulnerability resides in the implementation of the SAML SSO authentication service within FortiOS and FortiProxy software. SAML is a widely adopted open standard for exchanging authentication and authorization data between identity providers and service providers, commonly used in enterprise environments to enable seamless access to multiple applications with one login.

In a properly functioning SAML flow, a user's identity is verified by a trusted Identity Provider (IdP), which then generates a cryptographically signed assertion. This assertion is presented to the Service Provider (SP)—in this case, the Fortinet device—which validates the signature and grants access. The flaw in Fortinet's implementation allows an attacker to manipulate or forge this process, tricking the device into accepting an unauthorized user as a legitimate, authenticated administrator without ever contacting the legitimate IdP.

Exploitation does not require prior access or valid user credentials. An attacker can send specially crafted HTTP requests to the vulnerable SAML endpoint on the device's management interface. Successful exploitation grants the attacker the same level of access as a network administrator, enabling them to create new user accounts, change network policies, intercept traffic, install persistent backdoors, and use the compromised device as a foothold for lateral movement into the internal network.

Affected Products and Patching Imperative

Fortinet has identified and released patches for the following affected software versions:

• FortiOS (for FortiGate firewalls): All versions from 7.4.0 to 7.4.2, 7.2.0 to 7.2.6, and 7.0.0 to 7.0.13.
• FortiProxy Secure Web Gateway: All versions from 7.4.0 to 7.4.2 and 7.2.0 to 7.2.8.

Organizations running these versions must upgrade to the fixed releases immediately: FortiOS 7.4.3 or above, 7.2.7 or above, 7.0.14 or above; and FortiProxy 7.4.3 or above or 7.2.9 or above. Fortinet notes that versions 6.4, 6.2, 6.0, and earlier are not affected by this specific vulnerability.

Given the active exploitation, patching is the primary and non-negotiable mitigation. For devices that cannot be patched immediately, Fortinet recommends implementing strict access control lists (ACLs) to limit access to the management interface to only trusted IP addresses. However, this is a temporary workaround, as the underlying vulnerability remains. Network administrators should also review logs for any suspicious authentication attempts or unexpected administrative user creation, particularly from unfamiliar source IPs.

Broader Implications for Enterprise Security

The active exploitation of CVE-2024-21762 carries significant implications beyond the immediate need to patch. First, it highlights the extreme risk posed by vulnerabilities in internet-facing security appliances. These devices are designed to be the first line of defense; when compromised, they not only fail in their protective role but become powerful tools for the attacker.

Second, the flaw's location in a core authentication protocol like SAML SSO is particularly concerning. SAML is trusted precisely because it is designed to be secure and standardized. A bypass at this level undermines a fundamental trust mechanism for countless enterprises that rely on federated identity for secure access.

Finally, this event reinforces the critical importance of vulnerability management lifecycle speed. The window between patch availability and active exploitation is shrinking dramatically. Security teams must prioritize the rapid testing and deployment of patches for perimeter devices, especially those handling authentication. Automated patch management and robust asset inventory systems are no longer just best practices but essential components of a defensive strategy capable of responding to such high-velocity threats.

As threat actors continue to scan for and weaponize this flaw, the responsibility falls on network defenders to act with urgency. The compromise of a network firewall is a catastrophic event that can lead to data exfiltration, ransomware deployment, and severe operational disruption. Immediate action to identify, patch, and monitor affected Fortinet devices is the only effective response to this live and present danger.