This vulnerability (CVE-2024-26009) involves an authentication bypass via an alternate path or channel in Fortinet FortiProxy and other Fortinet products. It affects FortiProxy versions 7.0.0 to 7.0.15, 7.2.0 to 7.2.8, and 7.4.0 to 7.4.2, among others. An unauthenticated attacker can exploit this by crafting FGFM protocol requests to seize control of a managed device if it is managed by FortiManager and the attacker knows the FortiManager's serial number. The CVSS v3.1 base score is 7.9, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requires no privileges or user interaction. The vulnerability is officially published and a patch is available.

Successful exploitation allows an unauthenticated attacker to bypass authentication controls and execute arbitrary code or commands on managed devices, potentially leading to full compromise of the device's confidentiality, integrity, and availability. This could result in unauthorized control over network infrastructure components managed by FortiManager.

A patch is available for this vulnerability. It is recommended to apply the official Fortinet patches for affected FortiProxy versions and other impacted products as soon as possible. Since this is not a cloud service, remediation depends on the user applying the patch. No vendor advisory indicating 'no action required' or alternative mitigations was provided, so patching is the primary recommended action.