Loading story…
Fortinet disclosed CWE-602 authorization bypass flaws in FortiManager and FortiAnalyzer that let authenticated low-privilege users reach privileged web-console functions and perform unauthorized operations by sending crafted requests. The advisories say affected releases span multiple FortiManager, FortiAnalyzer, and FortiAnalyzer-BigData branches, while newer branches such as FortiAnalyzer 7.6 and FortiManager 7.6 are not affected and fixed versions are available for supported lines. Fortinet credited researchers from Orange Cyberdéfense, Orange CERT-CC, and Synacktiv for responsible disclosure.
Synacktiv detailed how the FortiManager issue, tracked as CVE-2024-23666, allowed a user with read-only or restricted privileges to access administrative features including full configuration backup, configuration import upload, and the remote SSH web console for managed FortiGate devices. Exported backups could expose hashed or encrypted credentials for FortiManager and managed devices, enabling further privilege escalation, and the configuration import path could be chained with CVE-2023-42791 to obtain root access on the underlying system. The researchers also published detection guidance aimed at spotting suspicious configuration downloads by non-admin accounts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Fortinet published advisory FG-IR-23-396 for another client-side enforcement of server-side security vulnerability affecting multiple FortiAnalyzer and FortiManager product lines. The company said an authenticated attacker with at least read-only permissions could execute sensitive operations by sending crafted requests, and credited Synacktiv researchers for the disclosure.
Fortinet published advisory FG-IR-23-187 for a client-side enforcement of server-side security flaw affecting FortiManager and FortiAnalyzer products. The advisory said a remote attacker with low privileges could access a privileged web console and execute some unauthorized commands, and it credited Orange Cyberdéfense and Orange CERT-CC for responsible disclosure.
Synacktiv published technical details about multiple FortiManager vulnerabilities, including an authorization bypass later identified as CVE-2024-23666 that lets a low-privilege authenticated user access administrative features. The write-up described impacts including configuration export, configuration import upload abuse, and access to the remote SSH web console for managed FortiGate devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have been actively targeting internet-exposed **Fortinet FortiGate** management interfaces to seize administrative control of firewalls, with reporting tying the activity to exploitation of **`CVE-2024-55591`** and a related authentication weakness, **`CVE-2025-24472`**. Fortinet said the primary flaw affects **FortiOS** and **FortiProxy** and stems from improper authentication in the Node.js websocket module, allowing an unauthenticated remote attacker to obtain **super-admin** access and full control of vulnerable devices. Observed intrusions included the creation of new administrator accounts, adding those accounts to **SSL VPN** groups, changing firewall policies, and using the compromised appliances to pivot into networks that were otherwise protected behind the VPN perimeter. Security guidance accompanying the disclosures urged organizations to apply Fortinet patches immediately, disable or restrict public exposure of management interfaces, harden FortiOS devices, and review logs for signs of compromise tied to the broader campaign against exposed firewall consoles.
Jul 24, 2026
Fortinet disclosed two critical vulnerabilities affecting **FortiWeb** and **FortiManager**, both of which have been exploited in the wild and can lead to full device compromise. In FortiWeb, multiple versions are affected by an unauthenticated SQL injection flaw that lets attackers send crafted HTTP or HTTPS requests to execute unauthorized SQL commands, bypass access controls, read sensitive configuration and user data, alter or delete database records, and potentially escalate to complete system takeover. Fortinet advised customers to upgrade immediately to fixed releases or disable the HTTP/HTTPS management interface as a temporary workaround. In FortiManager, the critical flaw tracked as `CVE-2024-47575` allows unauthenticated remote code execution and remote command execution, with exploitation observed globally and against Finnish organizations. A successful attack can give intruders control of vulnerable FortiManager systems and expose connected device configuration data and passwords. Fortinet issued patches for most affected branches, while **FortiManager Cloud 6.4** has no fix and must be upgraded; the company also warned that if exploitation is suspected, patching alone is insufficient and organizations should perform a full incident investigation using Fortinet’s compromise-assessment guidance.
Jun 29, 2026
Fortinet issued multiple 2026 security advisories covering a broad set of vulnerabilities across **FortiSandbox, FortiManager, FortiAnalyzer, FortiOS, FortiAP, FortiProxy, FortiPAM, FortiSwitchManager, FortiSwitchAXFixed,** and related cloud offerings. The most severe flaws affect **FortiSandbox**, including `CVE-2026-39808`, an unauthenticated OS command injection bug that could allow arbitrary command execution and full device compromise, `CVE-2026-39813`, a path traversal issue in the JRPC API that may enable authentication bypass and privilege escalation, and `CVE-2026-26083`, a missing authorization flaw that can expose restricted functionality and sensitive sandbox analysis data through the GUI without authentication. National cyber authorities in Canada and Belgium separately warned organizations to apply Fortinet’s fixes immediately. Fortinet also disclosed high-risk issues in management platforms, notably `CVE-2025-54820`, a stack-based buffer overflow in the **FortiManager** `fgtupdates` service that can let remote unauthenticated attackers execute unauthorized commands when the service is enabled, as well as a heap-based buffer overflow affecting **FortiAnalyzer Cloud** and **FortiManager Cloud**. Additional weaknesses across the product line include authentication and MFA bypasses, SQL injection, API denial of service, CLI command injection in FortiAP, CAPWAP daemon memory corruption in FortiOS, stored and reflected XSS, improper access control, and credential exposure. Fortinet advised customers to upgrade to fixed releases, disable exposed services such as `fgtupdates` where possible, restrict CLI, SSH, and API access, and monitor logs for anomalous authentication, privilege escalation, and endpoint activity.
Jun 29, 2026