Gunra Ransomware Hits Fortinet VPNs: CVE-2024-55591 Fix
.png)
By OpenVPN Team
The FBI, CISA, NSA and partners, including South Korea's National Police Agency, have issued a joint advisory: the Gunra ransomware operation is breaking into networks through Fortinet firewalls, bypassing MFA, stealing data, and encrypting what's left.
The uncomfortable detail: the two flaws it exploits were patched over a year ago — this is a story about the edge-appliance patch gap, and about what happens when your VPN concentrator is your only way in.
What is the Gunra ransomware campaign?
Gunra (also tracked as Golden Community) has matured into a full ransomware-as-a-service operation: affiliates get a management panel, a configurable builder, and cross-platform lockers, and they run double extortion — exfiltrate first, encrypt second, then threaten to publish. The joint advisory AA26-222A — released 2026-Aug-10 by the FBI, CISA, NSA, DoD Cyber Crime Center, U.S. Secret Service, and South Korea's National Police Agency — reports recent victims including critical-infrastructure organizations.
Which Fortinet vulnerability is Gunra exploiting? (CVE-2024-55591 and CVE-2025-24472)?
The advisory names two FortiOS/FortiProxy authentication-bypass flaws — both long since patched by Fortinet:
-
CVE-2024-55591 (critical) — remote attacker gains super-admin privileges via crafted requests to the Node.js websocket module.
-
CVE-2025-24472 (high) — remote unauthenticated attacker gains super-admin privileges via crafted CSF proxy requests.
If those IDs look old, that's the point: this Fortinet vulnerability pair has had fixes available for over a year. Gunra isn't burning 0-days — it's harvesting the long tail of unpatched edge devices. Every unpatched FortiGate vulnerability on an internet-facing interface is a standing invitation.
How Gunra bypasses MFA
According to the advisory, Gunra actors modified authentication-processing files on a compromised corporate VDI portal so that an attacker-controlled one-time password is always accepted — a persistent MFA bypass that survives the initial break-in. MFA still matters; it just can't save an appliance an attacker already has super-admin on.
How to protect your FortiGate right now
- Patch FortiOS/FortiProxy to fixed versions for CVE-2024-55591 and CVE-2025-24472 — Fortinet's PSIRT advisories list them per release train.
- Hunt, don't just patch. These flaws have been exploited since early 2025 — if your device sat unpatched, assume compromise and check for rogue admin accounts, modified auth files, and unexpected VPN logins per the IOCs in AA26-222A.
- Segment and reduce exposure. CISA's advisory specifically urges patching exposed VPNs and segmenting networks so one breached edge device can't reach everything.
What happens when your only remote-access path is the target?
The Gunra playbook targets the device that is the front door. During incident response — isolating the appliance, rebuilding it, rotating credentials — a FortiGate-only shop has no clean way for responders and staff to connect. The same fused firewall+VPN convenience that simplified the architecture becomes the single point of failure, for the exploit and for the recovery.
That's an architecture problem, not a Fortinet problem — every vendor ships vulnerabilities, including us. The fix is a second, independent path.
Vendor-diverse remote access: the break-glass layer
-
OpenVPN Access Server — self-hosted on your own VM, independent codebase, independent infrastructure. Keep it warm with admin break-glass profiles; if the edge appliance is compromised or quarantined, responders still get in through a path the attacker never touched.
- CloudConnexa — cloud-delivered ZTNA if you don't want to host the backup layer.
Supplier diversity for remote access turns "our firewall is being rebuilt" from a company-wide outage into a contained incident. This week the advisory names Fortinet; yesterday Cisco's ASA/FTD VPN was in the same spot — the pattern is the argument.
FAQ: Gunra ransomware and the Fortinet flaws
Is Gunra ransomware actively exploiting Fortinet devices?
Yes. A joint advisory from the FBI, CISA, NSA and partners (AA26-222A, released 2026-Aug-10) documents active exploitation of unpatched FortiOS/FortiProxy devices, including at critical-infrastructure organizations.
Which CVEs does Gunra ransomware use?
CVE-2024-55591 (critical, super-admin via Node.js websocket requests) and CVE-2025-24472 (high, super-admin via crafted CSF proxy requests) — both authentication bypasses in FortiOS/FortiProxy.
Is there a patch for these Fortinet flaws?
Yes — and there has been for a long time. Fortinet released fixes when the CVEs were disclosed (2024/2025). Devices being breached today are the unpatched remainder.
How does Gunra bypass MFA?
Per the advisory, actors modified authentication-processing files on a compromised VDI portal so an attacker-controlled one-time password is always accepted — persistence, not a flaw in MFA itself.