Loading story…
Fortinet experienced a significant stock decline of over 20% after its revenue forecasts failed to meet expectations, despite being recognized as an industry leader by Gartner for its hybrid mesh firewalls. The shortfall in projected earnings led investors to file two class action lawsuits, alleging that Fortinet violated federal securities laws by making misleading statements about a supposed "record" firewall refresh cycle that did not materialize in the company's financial results.
Industry experts highlight the importance of transforming financial forecasting from a narrative-driven process to one grounded in evidence, recommending a three-tiered validation approach involving finance, risk and compliance, and internal audit teams. Key steps include establishing immutable audit trails and automated reconciliation across core systems to ensure transparency and accuracy in financial reporting, thereby reducing the risk of legal liabilities stemming from inaccurate forecasts.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
Following the stock decline, investors filed two federal securities class action lawsuits against Fortinet alleging misleading statements tied to its revenue forecast. The suits claim the company's growth narrative was not supported by underlying business realities.
In August, Fortinet's stock dropped by more than 20% after the anticipated firewall refresh-driven revenue failed to materialize. The decline triggered scrutiny of whether the company's prior guidance was adequately supported by operational data.
Fortinet gave investors revenue guidance linked to what was described as a record firewall refresh cycle. The article indicates this forecast later became the basis for allegations that the company's statements were misleading.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet survey findings reported by *TechRadar* and *CIO* indicate that expanding hybrid and multi-cloud adoption—often tied to broader AI initiatives—is widening organizations’ cloud attack surfaces while security operations struggle with **tool sprawl** and limited end-to-end visibility. The research reports **88%** of organizations operate hybrid or multi-cloud environments, and **81%** rely on two or more cloud providers for critical workloads, increasing complexity across identities, permissions, configurations, and data paths. The survey highlights persistent capability gaps: **69%** cite cloud security barriers driven by tool sprawl and visibility gaps, and **59%** say their cloud security maturity remains in early/developing stages. Confidence in real-time detection and response is weak (**66%** lack strong confidence), and automation is largely limited to alerting, with only **11%** reporting autonomous remediation. The top anticipated risk areas are **identity and access management (77%)**, **misconfigurations/cloud security posture (70%)**, and **data exposure (66%)**; Fortinet also notes cloud incidents often result from chained weaknesses along an “exposure path” (e.g., misconfiguration plus excessive privileges leading to sensitive data access). Despite these gaps, **62%** expect cloud security budgets to increase, averaging **34%** of IT security budgets, with Fortinet recommending unified visibility, tool consolidation, connecting risk domains, and greater automation to reduce operational burden and improve response.
Jun 29, 2026
Italian and Colombian cyber authorities issued alerts on vulnerabilities affecting **Fortinet** products, with CSIRT Italia detailing multiple information-disclosure flaws in **FortiSandbox** and **FortiAuthenticator** and warning that two of the issues are rated **high severity**. The disclosed weaknesses could allow a malicious user to access sensitive information on affected systems, expanding risk for organizations that rely on these appliances for authentication and sandboxing functions. CSIRT Italia said the affected products span specific version ranges and urged administrators to apply the updates referenced in Fortinet security bulletins. Separate **COLCERT** alerts also warned of **critical vulnerabilities** in Fortinet products, reinforcing the need for immediate review of exposed deployments even though the Colombian notices provided limited technical detail on affected versions, CVE identifiers, or exploitation activity.
Aug 1, 2026
A large-scale campaign dubbed **FortiBleed** harvested credentials from internet-facing Fortinet devices, with researchers reporting stolen data from more than 70,000 to 75,000 devices across up to 194 countries and evidence that more than 430,000 FortiGate firewalls were targeted. SOCRadar said the operators used default or previously leaked credentials to access devices, deployed a custom packet-sniffing implant known as **FortiGate Sniffer**, captured VPN and other authentication data in real time, and in some cases left persistent backdoor accounts such as `adminin`. Open-source reporting and government alerts also tied the activity to Fortinet flaws including `CVE-2024-55591`, `CVE-2025-59718`, and `CVE-2025-59719`, while Fortinet disputed claims that the exposed credentials reflected a new product breach and said some data may have come from earlier compromises or brute-force activity. The stolen access was allegedly linked to the **INC** and **Lynx** ransomware ecosystems, with researchers citing exposed infrastructure, ransomware negotiation-panel artifacts, credential-stuffing systems, and cases where intrusions progressed to encryption of hundreds of endpoints. Reports said credentials belonging to UK government officials, Foreign Office staff, embassy personnel, NHS trusts, local councils, energy firms, and pharmaceutical suppliers were offered for sale on dark-web forums, raising concern over follow-on attacks against sensitive networks. National defenders including the UK NCSC and Brazil's CTIR Gov urged organizations using Fortinet firewalls and SSL VPNs to review accounts, remove unauthorized users, terminate sessions, reset passwords, enforce MFA, patch affected systems, and inspect logs for signs of compromise and lateral movement.
Aug 15, 2026