Cyber Resilience

CVE-2024-52965

High

Published: 08 July 2025

Published
08 July 2025
Modified
22 July 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0013 32.6th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-52965 is a high-severity Missing Critical Step in Authentication (CWE-304) vulnerability in Fortinet Fortios. Its CVSS base score is 7.2 (High).

Operationally, ranked at the 32.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A missing critical step in authentication vulnerability [CWE-304] in Fortinet FortiOS version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.10, and before 7.0.16 & FortiProxy version 7.6.0 through 7.6.1, 7.4.0 through 7.4.8, 7.2.0 through 7.2.13 and before 7.0.20 allows…

more

an API-user using api-key + PKI user certificate authentication to login even if the certificate is invalid.

CWE(s)
CWE-304NVD-CWE-Other

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

fortinet
fortiproxy
7.0.0 — 7.0.21 · 7.2.0 — 7.2.14 · 7.4.0 — 7.4.9
fortinet
fortios
7.6.0, 7.6.1 · 7.0.1 — 7.0.17 · 7.2.0 — 7.2.11 · 7.4.0 — 7.4.6

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

IA-8 Identification and Authentication (Non-organizational Users)
addresses: CWE-304

Ensures the authentication process is followed for non-organizational users, avoiding missing critical steps.

References