Actively Exploited Fortinet Zero-Day Gives Attackers Super-Admin Privileges

Fortinet released a patch for CVE-2024-55591, a critical (CVSS 9.6) authentication-bypass in FortiOS/FortiProxy's jsconsole WebSocket that has been actively exploited to create admin accounts, modify device configurations, and use SSL VPN to access internal networks; researchers detailed a four-step exploit chain (pre-auth WebSocket, local_access_token session bypass, WebSocket Telnet race condition, and privilege selection) and Fortinet recommends following its upgrade path or applying provided workarounds and using non-guessable admin usernames.