CVE-2024-55591Vulnerability

1. “Harden edge devices: patch and review FortiGate configurations, including exposure to CVE-2024-55591, and rotate VPN credentials, given The Gentlemen’s FortiGate-based victim selection”

   SOCRadarVendor20 Oct 2026
   Japan Data Breaches 2026: Inside the October Surge

2. “…iance matching the 19+ CVEs in this campaign’s arsenal, prioritizing Sophos XG (CVE-2022-1040), WordPress (CVE-2026-63030), FortiOS (CVE-2024-55591), F5 BIG-IP (CVE-2023-46747), SAP NetWeaver (CVE-2025-31324), and Roundcube (CVE-2025-49113 / CVE-2025-25257).”

   SOCRadarVendor26 Sep 2026
   Operation Talked: A Russia-Linked Cyber Espionage Campaign Targeting Ukraine’s Defense Industry

3. “CVE-2024-55591”

   Recorded FutureVendor8 Sep 2026
   August 2026 CVE Landscape

4. “…escribed how affiliates conducted reconnaissance to identify internet-exposed FortiGate firewall management interfaces vulnerable to CVE-2024-55591.”

   Sophos X-OpsVendor1 Sep 2026
   Ungentlemanly behavior: Insights into a ransomware operation

5. “CVE-2024-55591 is a critical flaw which allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module”

   Infosecurity MagazineNews12 Aug 2026
   Gunra Ransomware Exploits Fortinet Flaws to Target Critical Infrastructure

6. “…dge devices, such as in Citrix NetScaler ADC and Gateway (CVE-2025-5777), SonicWall SSL VPN (CVE-2024-40766) and Fortinet’s FortiOS (CVE-2024-55591) were among the most exploited by ransomware groups during the reported period.”

   Infosecurity MagazineNews27 Jul 2026
   Ransomware Groups Increasingly Deploy EDR Kill Techniques

7. “Entry typically comes through Fortinet edge devices exploiting CVE-2024-21762 and CVE-2024-55591.”

   Group-IBVendor23 Jul 2026
   Ransomware in 2026: Same Business, New Rules

8. “…luding initial access vectors (such as edge appliances), CVEs the actors are tracking (including Fortinet authentication bypass flaw CVE-2024-55591), and how ransom negotiations play out.”

   HuntressVendor21 May 2026
   The Gentleman Ransomware | Defense Evasion TTPs Uncovered

9. “Primary attack vector exploits CVE-2024-55591, a critical authentication bypass in FortiOS/FortiProxy.”

   Group-IBVendor19 Mar 2026
   How Hastalamuerte Operates: Group-IB’s Analysis of The Gentlemen’s Attack Methods

Also named with it: CVE-2025-49113, CVE-2026-63030, CVE-2022-1040, CVE-2023-46747, CVE-2025-24472, CVE-2025-31324, CVE-2026-68820, CVE-2026-65400, CVE-2026-60004, CVE-2026-64849, CVE-2026-33824, CVE-2025-5777, CVE-2026-0300, CVE-2026-33017, CVE-2017-0199, CVE-2022-0847, CVE-2026-34486, CVE-2026-39987, CVE-2021-3156, CVE-2021-29441