CVE-2024-55591
Actively exploited. CVE-2024-55591 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2025-01-14) — exploitation has been observed in the wild, and US federal agencies are required to remediate it under BOD 22-01. Treat patching as urgent.
Public exploit code is available. Proof-of-concept or working exploit code for CVE-2024-55591 is indexed in GitHub PoC and Nuclei. Expect opportunistic scanning and exploitation attempts — prioritize remediation.
Advisory at a Glance Title #StopRansomware: Gunra Ransomware Original Publication August 10, 2026 Executive Summary Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical infrastructure, and other organizations. The Gunra ransomware variant first appeared in 2025 and expanded to RaaS operations in 2026. The actors leverage a double-extortion model, both encrypting data and threatening to publish exfiltrated data to a dedicated leak site (DLS) if the ransom is not paid. This advisory provides technical details of the activity, as well as tailored detection and mitigation guidance to protect at-risk organizations from Gunra. Key Actions Prioritize patching known exploited vulnerabilities in internet-facing systems , including virtual private network (VPN) gateways and remote desktop protocol (RDP)-exposed infrastructure. Implement and test offline, immutable backups stored in a physically separate, segmented location to ensure recoverability without ransom payment. Segment networks to restrict lateral movement from an initially compromised device to other systems in the organization. Indicators of Compromise For a downloadable copy of indicators of compromise, see: AA26-222A STIX XML (54 KB) AA26-222A STIX JSON (61 KB) Intended Audience Organizations: Government, Critical Infrastructure Sectors: Healthcare and public health , financial services and insurance, critical manufacturing and construction, transportation systems and logistics, government services and facilities , utilities, academia, media and communications, retail, and professional and nonprofit services. Roles: Cybersecurity architects , defensive cybersecurity analysts , vulnerability analysts , systems administrators , and security systems managers . Introduction Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #S
CSIRTS triage
- What
- Gunra ransomware-as-a-service employs double-extortion attacks against government and critical infrastructure by encrypting data and threatening to publish exfiltrated files.
- Who is affected
- Government agencies, critical infrastructure organizations, and other entities with internet-facing VPN gateways and RDP infrastructure.
- Urgency
- Critical; Gunra is actively exploited in the wild and leverages known CVEs (CVE-2024-55591, CVE-2025-24472) for initial access.
- Action
- Immediately patch known exploited vulnerabilities in internet-facing systems, particularly VPN gateways and RDP-exposed infrastructure, and implement offline backup and immutability testing.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2024-55591
Get an email if CVE-2024-55591 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Exploitation confirmedAlready exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 99.9% of all EPSS-scored CVEs.
Exploit availability
Public exploit or proof-of-concept code for CVE-2024-55591 is indexed in these free datasets. Available exploit code raises real-world risk independent of the CVSS score.
- GitHub PoCPublic proof-of-concept repositories on GitHub reference this CVE.look it up ↗
- NucleiA nuclei-templates detection/PoC template exists for this CVE.look it up ↗
Advisory coverage (4)
- criticalexploited#StopRansomware: Gunra Ransomwarecisa · 2026-08-10
- criticalexploitedAL26-014 – FortiBleed leak of thousands of compromised credentials impacting Fortinet devicescccs · 2026-06-18
- unknownexploited[Update] Vulnerability in Fortinet products (January 14, 2025)cert-fr-alerte · 2025-01-14
- criticalexploitedCVE-2024-55591: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerabilitycisa-kev · 2025-01-14
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2024-55591)