type: cve · created: 2026-08-12 · updated: 2026-08-12 · tags: [cve, fortinet, fortios, forti-proxy, exploited, ransomware] · confidence: high · severity: not-rated · affected_sectors: [technology, government, finance] · au_impact: true
CVE-2025-24472 — Fortinet FortiOS/FortiProxy
CVE-2025-24472 affects Fortinet FortiOS/FortiProxy and is being exploited by the Gunra ransomware operation (a Conti-derived RaaS) to gain initial access to victim networks, per new reporting on the joint FBI/CISA Gunra advisory.
Vulnerability Details
| Attribute | Detail |
|---|---|
| CVE | CVE-2025-24472 |
| Product | Fortinet FortiOS / FortiProxy |
| Exploitation status | Exploited by Gunra ransomware for initial access (reported 2026-08-11) |
Context
Gunra gains initial access via CVE-2024-5559 (Schneider Electric PowerLogic P5) and CVE-2025-24472 (Fortinet FortiOS/FortiProxy), then deploys its double-extortion locker. FortiOS/FortiProxy are internet-facing firewall/VPN appliances; the digest reinforces that Australian organisations should expect initial-access tradecraft against exposed Fortinet and Schneider Electric appliances.
Related Pages
- Gunra Ransomware Exploits Fortinet And Schneider Electric Flaws To Breach Networ — the Gunra exploitation incident
Sources: raw/digests/Cyber-Digest-2026-08-12