Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability (CVE-2024-55591)
In February 2026, CrowdStrike Counter Adversary Operations identified an open directory controlled by the Iran-nexus adversary STATIC KITTEN on IP address 157.20.182[.]49 containing 1.9 GB of data and more than 20,000 files. Among them was a modified version (SHA256 hash: fd6b46d148af22da6163f18ce43b35ebb827cc6e140f03f0f514bc2a6f548743) of a public POC exploit for a FortiOS and FortiProxy authentication bypass vulnerability (CVE-2024-55591) first released by a well-known industry source on January 27, 2025.4
Where the public POC exploit executed a single user-provided command, the modified version contained 13 hardcoded payloads designed to enumerate targets, create users, and establish persistence. The modifications reflect a systematic approach to turning a demonstration tool into a more comprehensive exploit.
| Payload Name | Description |
test |
Creates the backdoor admin user FortiWiFi with password FortiWiFi123 and assigns this user the super_admin profile, granting full system access |
test2 |
Lists all user groups in the victim system, likely to facilitate reconnaissance in order to understand the victim system’s existing group structure |
test3 |
Displays all local user accounts, allowing the attacker to enumerate existing users |
test4 |
Modifies the FortiWiFi admin account by assigning it the ssl-vpn-groupamoss access profile |
test5 |
Creates the FortiWiFi user with password FortiWiFi123, adds this user to the ssl-vpn-groupamoss group, and then displays all user groups to verify the user was successfully added to the group |
test6 |
Creates or modifies a user group named ssl-vpa-amoss and adds multiple users to this group, including the backdoor FortiWiFi account (created by test1 or test5) and users with transliterated Hebrew-language names (i.e., shachar, sigal, amos, sima, lev, and gabi) |
test7 |
Queries the ssl-vpn-groupamoss group configuration’s help information, likely to understand available options for follow-on activities |
test8 |
Creates the backdoor user darlen with password 1234 |
test9 |
Similar to the test payload, creates the FortiWiFi user with password FortiWiFi123 or updates the existing FortiWiFi user to use that password |
test10 |
Creates the FortiWiFi user with password 1234 and adds this user (along with numerous other users, many with transliterated Hebrew-language names) to the VPN-Users group, potentially to hide the backdoor account among legitimate users |
test11 |
Creates a system admin account named FortiSetup with super_admin privileges and an encrypted password (decrypted password is gwm1607pmw); this account provides a more sophisticated backdoor than those created by other payloads, as FortiSetup has root VDOM access |
test12 |
Displays the FortiAdmin account’s configuration, likely to facilitate reconnaissance |
test13 |
Creates a user named offices with an email address and an encrypted password (decrypted password is @lolo@123456); POC_ZZ_1.py‘s developer may have added this email address to make the new user appear legitimate |
Whether STATIC KITTEN modified the public CVE-2024-55591 exploit themselves or obtained this modified version from another source remains unknown. However, as of this writing, CrowdStrike Counter Adversary Operations has not observed any other adversaries using this modified POC or infrastructure hosting it.
AI’s Impact on the Vulnerability Research Ecosystem
AI advancements are undoubtedly accelerating the speed and scope of how vulnerabilities are discovered and weaponized.5 One only has to look at the substantial increase in the number of vulnerabilities in recent Microsoft Patch Tuesdays compared to prior to the advent of frontier models earlier this year.6
Detecting and attributing adversaries’ direct use of AI for vulnerability research purposes remains hard to identify due to inherent visibility gaps and the fact there is no single identifier that distinguishes AI-generated exploit code. Complicating things further, is that the patterns suggesting AI assistance (such as well-commented code, improvements to existing POCs, or structured code organization) are also consistent with the output of someone with high technical capabilities.
Nonetheless, threat actors are leveraging AI to augment their vulnerability research. CrowdStrike Intelligence assesses they will almost certainly continue to do so through at least three vectors:
- Direct interaction with frontier models by trying to “jailbreak” AI safeguards and bypass any export control restrictions
- Modifying open-weight proprietary models for malicious use by extracting safeguards; these are not/less monitored for abuse by frontier AI companies
- Adopting AI-led/assisted public vulnerability research published by industry sources
The third point, while not a direct use, is the easiest to detect. One only has to look at the CopyFail vulnerability detailed in this blog post, whose discovery was allegedly facilitated by AI.7 Or the mass exploitation of wp2shell in July 2026, which is the first critical unauthenticated WordPress Core remote code execution (RCE) purportedly discovered in nearly a decade and was allegedly discovered using GPT5.6 Sol Ultra and $25 USD worth of tokens.8
Outlook
Adversaries will almost certainly continue using public vulnerability research as part of their offensive toolkit through the foreseeable future. As more POC exploits become routinely available within hours of disclosure, at least partially driven by AI-assisted vulnerability research, the number of threat actors using them will almost certainly increase. Over the next year, this will likely manifest itself in the rise of widespread exploitation campaigns resulting in contested environments, like the cPanel CVE-2026-41940 exploitation example covered in this blog post.
This expanding pool of adversaries leveraging public vulnerability research, combined with the rapid speed at which adversaries are operationalizing public research, reinforces three key points.
The first is that patch prioritization is harder than ever. As vulnerability disclosures continue to increase in volume, predicting which ones will attract public research (and therefore adversary attention) becomes a genuine intelligence challenge. Because adversaries have access to the same advisories and public exploits that defenders do, organizations that rely solely on CVSS scores to drive patching decisions are relying on the wrong signal. Real-world exploitability, ease of exploitation (i.e., if there is a public exploit or exploitation guidance), and adversary intent are what separate the vulnerabilities that matter from the ones that do not.
The second is that the time to patch is effectively zero. The data from the first half of 2026 shows this: 91% of vulnerabilities with POCs that CrowdStrike has seen exploited were weaponized and used in the wild within 48 hours, with the fastest observation occurring just 35 minutes after a POC became available. Adversaries treat public vulnerability research as the starting gun, and legacy patch cycles measured in weeks or days cannot compete.
Lastly, more threat actors can participate in exploitation. As the case studies show, adversaries across skill and resource levels are operationalizing public research, some using POCs with minimal modification and others refining them (as UMBRAL BISON and STATIC KITTEN both demonstrated). When motivation and intent are the only remaining barriers to exploitation, the volume of participating adversaries significantly increases.
The vulnerability research ecosystem is one of the security community’s greatest assets and most significant challenges. Defenders who treat public research as a threat actor’s green light, and who build the intelligence, patching timelines, and detection capabilities to match, are the ones who will keep pace.
Jaime Duque and Lacie Blythe are Senior Intelligence Analysts at CrowdStrike. This research was presented at Day Zero 2026.
Additional Resources
1 https://labs.watchtowr.com/the-internet-is-falling-down-falling-down-falling-down-cpanel-whm-authentication-bypass-cve-2026-41940/ || https://github.com/watchtowrlabs/watchTowr-vs-cPanel-WHM-AuthBypass-to-RCE.py
2 https://www.reddit.com/r/cpanel/comments/1syyajp/comment/oiyg0fr/
3 https://xint.io/blog/copy-fail-linux-distributions || https://github.com/theori-io/copy-fail-CVE-2026-31431
4 https://labs.watchtowr.com/get-fortirekt-i-am-the-super_admin-now-fortios-authentication-bypass-cve-2024-55591/ || https://github.com/watchtowrlabs/fortios-auth-bypass-poc-CVE-2024-55591
5 https://www.crowdstrike.com/en-us/blog/tune-in-future-of-ai-powered-vulnerability-discovery/
6 https://www.microsoft.com/en-us/security/blog/2026/10/06/ciso-perspectives-on-managing-vulnerability-risks-in-the-age-of-ai/
7 https://xint.io/blog/copy-fail-linux-distributions
8 https://www.wordfence.com/blog/2026/07/wp2shell-aftermath-the-first-critical-unauthenticated-wordpress-core-rce-in-nearly-a-decade/ || https://www.slcyber.io/research/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6#the-story-of-wp2shell
