Loading story…
Fortinet patched multiple vulnerabilities in FortiOS and FortiProxy, led by critical captive-portal flaws CVE-2023-42789 (out-of-bounds write) and CVE-2023-42790 (stack-based buffer overflow). Devices with captive portal enabled could be exposed to arbitrary code or command execution through specially crafted HTTP requests; Fortinet rated the flaws CVSS 9.3 and reported no known exploitation when the advisory was issued. The updates also address CVE-2024-23112, an SSL VPN web-mode bookmark authorization bypass that lets an authenticated user manipulate a URL to access another user's bookmark, and CVE-2023-46717, which can elevate a read-only user's privileges to read-write where FortiAuthenticator is deployed in high-availability mode.
Organizations should upgrade affected FortiOS and FortiProxy installations to Fortinet's fixed releases promptly, prioritizing internet-facing systems and appliances using captive portals. Until patching is complete, Fortinet recommends disabling form-based authentication schemes to mitigate the captive-portal RCE flaws, disabling SSL VPN web mode to mitigate bookmark exposure, and disabling FortiToken Mobile push notifications in FortiAuthenticator RADIUS policies for affected HA deployments. FortiSASE 23.3.b already includes fixes for the two captive-portal vulnerabilities.
Map this exposure pattern across your cloud, code, and identities.
4 events from the most recent confirmed update back to the earliest known activity.
Fortinet corrected the affected-version information in its advisory for the FortiAuthenticator HA improper-authentication vulnerability.
Fortinet published an advisory for CVE-2024-23112, a CWE-639 user-controlled-key vulnerability in FortiOS and FortiProxy SSL VPN bookmarks. An authenticated attacker could manipulate a URL to access another user's bookmark; Fortinet supplied fixed releases and advised disabling SSL VPN web mode as a workaround.
Fortinet published an advisory for CVE-2023-42789 and CVE-2023-42790, an out-of-bounds write and stack-based buffer overflow in FortiOS and FortiProxy captive portal functionality. The critical flaws could permit unauthenticated arbitrary code or command execution through crafted HTTP requests on devices with captive portal enabled; Fortinet issued fixed versions, a configuration workaround, and a virtual patch signature.
Fortinet published an advisory for CVE-2023-46717, an improper-authentication vulnerability affecting FortiOS deployments using FortiAuthenticator in high-availability mode. An authenticated user with read-only permissions could obtain read-write access through successive login attempts; fixed FortiOS releases and a push-notification workaround were provided.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
4 references tracked. Mallory keeps watching after this page renders.
fortiguard.fortinet.com
Open sourcefortiguard.fortinet.com
Open sourcefortiguard.fortinet.com
Open sourcencsc.nl
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed multiple critical vulnerabilities in **FortiOS** and related products, including an authentication bypass in **FortiOS** and **FortiProxy** that can grant attackers **super-admin privileges** and is being **actively exploited in the wild**. The flaw can be triggered through specially crafted requests to the **Node.js websocket module** and affects FortiOS `7.0.0` through `7.0.16`, FortiProxy `7.2.0` through `7.2.12`, and FortiProxy `7.0.0` through `7.0.19`. Organizations were told to upgrade to FortiOS `7.0.17+`, FortiProxy `7.2.13+`, or FortiProxy `7.0.20+`, and to apply Fortinet’s recommended mitigations immediately. Separate Fortinet advisories also warned of critical flaws **CVE-2024-21762** and **CVE-2024-23113**, affecting **FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager**. **CVE-2024-21762** carries a **CVSS 9.6** rating, while **CVE-2024-23113** is rated **CVSS 9.8**; both require urgent patching to fixed versions identified by Fortinet. Fortinet and national cyber authorities said defenders should prioritize upgrades across exposed appliances, and for `CVE-2024-21762`, disabling the **SSL VPN** feature can reduce exposure until patches are applied.
Jun 29, 2026
Fortinet disclosed **CVE-2023-25610**, a critical buffer-underwrite flaw in the HTTP/HTTPS administrative interface of FortiOS and FortiProxy. A remote, unauthenticated attacker can send crafted requests to execute arbitrary code on vulnerable appliances; certain additional Fortinet products may be susceptible to denial-of-service conditions. A public proof of concept was released shortly after the advisory, increasing the risk of exploitation. Organizations should immediately apply Fortinet’s updates and, where patching cannot occur promptly, restrict or disable internet-exposed HTTP/HTTPS administrative access. Wiz reported that 9% of cloud enterprise environments were exposed and that 80% of surveyed FortiOS-using environments had not yet patched.
Sep 3, 2026
Fortinet released fixes for two **critical** vulnerabilities that could let remote, unauthenticated attackers run unauthorized code or commands on exposed systems. The first, **`CVE-2026-44277`**, is an improper access control flaw in **FortiAuthenticator** with a **CVSS 9.1** rating; it affects versions **8.0.0**, **8.0.2**, **6.6.0-6.6.8**, and **6.5.0-6.5.6**, and was patched in **8.0.3**, **6.6.9**, and **6.5.7**. Fortinet said the issue stems from insufficient authorization checks on API endpoints and could allow unauthorized API access, privilege escalation, and command execution, while **FortiAuthenticator Cloud is not affected**. Fortinet also disclosed **`CVE-2026-26083`**, a **CVSS 9.1** missing-authorization flaw in the **FortiSandbox** Web UI that impacts **FortiSandbox**, **FortiSandbox Cloud**, and **FortiSandbox PaaS**, potentially enabling arbitrary code execution across on-premises and cloud deployments. Canada’s Cyber Centre warned that the advisories span multiple Fortinet products and urged administrators to review Fortinet PSIRT notices and apply updates promptly. Public reporting said Fortinet had not observed either flaw being exploited in the wild at disclosure, but the breadth of affected security infrastructure and Fortinet’s history of high-value exploitation have increased urgency around patching exposed appliances.
Jun 29, 2026