Loading story…
Fortinet disclosed multiple critical vulnerabilities in FortiOS and related products, including an authentication bypass in FortiOS and FortiProxy that can grant attackers super-admin privileges and is being actively exploited in the wild. The flaw can be triggered through specially crafted requests to the Node.js websocket module and affects FortiOS 7.0.0 through 7.0.16, FortiProxy 7.2.0 through 7.2.12, and FortiProxy 7.0.0 through 7.0.19. Organizations were told to upgrade to FortiOS 7.0.17+, FortiProxy 7.2.13+, or FortiProxy 7.0.20+, and to apply Fortinet’s recommended mitigations immediately.
Separate Fortinet advisories also warned of critical flaws CVE-2024-21762 and CVE-2024-23113, affecting FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager. CVE-2024-21762 carries a CVSS 9.6 rating, while CVE-2024-23113 is rated CVSS 9.8; both require urgent patching to fixed versions identified by Fortinet. Fortinet and national cyber authorities said defenders should prioritize upgrades across exposed appliances, and for CVE-2024-21762, disabling the SSL VPN feature can reduce exposure until patches are applied.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Fortinet disclosed a critical authentication bypass vulnerability in FortiOS and FortiProxy that can grant an attacker super-admin privileges via specially crafted requests to the Node.js websocket module. Fortinet said the flaw was being actively exploited in the wild and advised customers to upgrade to fixed versions or apply recommended mitigations.
Fortinet disclosed multiple critical vulnerabilities affecting FortiOS and other products, notably CVE-2024-21762 and CVE-2024-23113, and identified affected and fixed versions. The guidance included urgent patching and a mitigation note that disabling SSL VPN could help reduce exposure to CVE-2024-21762.
A vulnerability notice reported a critical flaw affecting FortiOS, FortiOS-6K7K, and FortiProxy across multiple release branches, and listed minimum patched versions required for remediation. Organizations were advised to upgrade to fixed releases including FortiOS 7.4.0/7.2.5/7.0.12 and FortiProxy 7.2.4/7.0.10/2.0.13 or later.
A notice warned of critical vulnerabilities in FortiOS, FortiProxy, FortiSwitchManager, and FortiTester and provided fixed versions for affected release lines. It also advised organizations unable to patch immediately to restrict network access to management interfaces using firewall rules.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed two critical vulnerabilities affecting **FortiWeb** and **FortiManager**, both of which have been exploited in the wild and can lead to full device compromise. In FortiWeb, multiple versions are affected by an unauthenticated SQL injection flaw that lets attackers send crafted HTTP or HTTPS requests to execute unauthorized SQL commands, bypass access controls, read sensitive configuration and user data, alter or delete database records, and potentially escalate to complete system takeover. Fortinet advised customers to upgrade immediately to fixed releases or disable the HTTP/HTTPS management interface as a temporary workaround. In FortiManager, the critical flaw tracked as `CVE-2024-47575` allows unauthenticated remote code execution and remote command execution, with exploitation observed globally and against Finnish organizations. A successful attack can give intruders control of vulnerable FortiManager systems and expose connected device configuration data and passwords. Fortinet issued patches for most affected branches, while **FortiManager Cloud 6.4** has no fix and must be upgraded; the company also warned that if exploitation is suspected, patching alone is insufficient and organizations should perform a full incident investigation using Fortinet’s compromise-assessment guidance.
Jun 29, 2026
Fortinet issued multiple 2026 security advisories covering a broad set of vulnerabilities across **FortiSandbox, FortiManager, FortiAnalyzer, FortiOS, FortiAP, FortiProxy, FortiPAM, FortiSwitchManager, FortiSwitchAXFixed,** and related cloud offerings. The most severe flaws affect **FortiSandbox**, including `CVE-2026-39808`, an unauthenticated OS command injection bug that could allow arbitrary command execution and full device compromise, `CVE-2026-39813`, a path traversal issue in the JRPC API that may enable authentication bypass and privilege escalation, and `CVE-2026-26083`, a missing authorization flaw that can expose restricted functionality and sensitive sandbox analysis data through the GUI without authentication. National cyber authorities in Canada and Belgium separately warned organizations to apply Fortinet’s fixes immediately. Fortinet also disclosed high-risk issues in management platforms, notably `CVE-2025-54820`, a stack-based buffer overflow in the **FortiManager** `fgtupdates` service that can let remote unauthenticated attackers execute unauthorized commands when the service is enabled, as well as a heap-based buffer overflow affecting **FortiAnalyzer Cloud** and **FortiManager Cloud**. Additional weaknesses across the product line include authentication and MFA bypasses, SQL injection, API denial of service, CLI command injection in FortiAP, CAPWAP daemon memory corruption in FortiOS, stored and reflected XSS, improper access control, and credential exposure. Fortinet advised customers to upgrade to fixed releases, disable exposed services such as `fgtupdates` where possible, restrict CLI, SSH, and API access, and monitor logs for anomalous authentication, privilege escalation, and endpoint activity.
Jun 29, 2026
Fortinet has disclosed and patched two critical authentication bypass vulnerabilities, identified as CVE-2025-59718 and CVE-2025-59719, affecting multiple products including FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. These flaws, rated with a CVSS score of 9.1, stem from improper verification of cryptographic signatures in the FortiCloud SSO login process. An unauthenticated attacker could exploit these vulnerabilities by sending a crafted SAML message, potentially gaining unauthorized administrative access if FortiCloud SSO is enabled. By default, FortiCloud SSO is disabled, but it is automatically enabled during FortiCare registration unless the administrator explicitly disables the relevant toggle. Fortinet has released fixed versions for all affected products and strongly recommends that organizations upgrade immediately. As a temporary mitigation, disabling the FortiCloud SSO login feature is advised until the upgrade can be completed. There is currently no evidence of exploitation in the wild, and no public proof-of-concept code is available, but the history of threat actors targeting Fortinet products underscores the urgency of patching. The vulnerabilities impact a range of versions across FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, with unaffected versions and upgrade paths detailed in the advisories.
Jun 29, 2026