Loading story…
Attackers have been actively targeting internet-exposed Fortinet FortiGate management interfaces to seize administrative control of firewalls, with reporting tying the activity to exploitation of CVE-2024-55591 and a related authentication weakness, CVE-2025-24472. Fortinet said the primary flaw affects FortiOS and FortiProxy and stems from improper authentication in the Node.js websocket module, allowing an unauthenticated remote attacker to obtain super-admin access and full control of vulnerable devices.
Observed intrusions included the creation of new administrator accounts, adding those accounts to SSL VPN groups, changing firewall policies, and using the compromised appliances to pivot into networks that were otherwise protected behind the VPN perimeter. Security guidance accompanying the disclosures urged organizations to apply Fortinet patches immediately, disable or restrict public exposure of management interfaces, harden FortiOS devices, and review logs for signs of compromise tied to the broader campaign against exposed firewall consoles.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Fortinet released security updates to address CVE-2024-55591, an actively exploited critical authentication flaw, and CVE-2025-24472, another authentication weakness that could allow full system control via crafted CFS proxy requests. The updates were issued in response to the risk to FortiOS and FortiProxy devices.
During the exploitation campaign, attackers created new administrative accounts, added them to SSL VPN groups, modified firewall rules, and used those changes to pivot into protected VPN networks. These actions were described as observed attacker behavior on compromised devices.
According to Fortinet reporting cited by CSIRT.SK, exploitation of CVE-2024-55591 against internet-exposed FortiOS and FortiProxy management interfaces has been observed since at least mid-November 2024. The activity involved gaining super-admin access and full control of affected devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed multiple critical vulnerabilities in **FortiOS** and related products, including an authentication bypass in **FortiOS** and **FortiProxy** that can grant attackers **super-admin privileges** and is being **actively exploited in the wild**. The flaw can be triggered through specially crafted requests to the **Node.js websocket module** and affects FortiOS `7.0.0` through `7.0.16`, FortiProxy `7.2.0` through `7.2.12`, and FortiProxy `7.0.0` through `7.0.19`. Organizations were told to upgrade to FortiOS `7.0.17+`, FortiProxy `7.2.13+`, or FortiProxy `7.0.20+`, and to apply Fortinet’s recommended mitigations immediately. Separate Fortinet advisories also warned of critical flaws **CVE-2024-21762** and **CVE-2024-23113**, affecting **FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager**. **CVE-2024-21762** carries a **CVSS 9.6** rating, while **CVE-2024-23113** is rated **CVSS 9.8**; both require urgent patching to fixed versions identified by Fortinet. Fortinet and national cyber authorities said defenders should prioritize upgrades across exposed appliances, and for `CVE-2024-21762`, disabling the **SSL VPN** feature can reduce exposure until patches are applied.
Jun 29, 2026
Fortinet disclosed two critical vulnerabilities affecting **FortiWeb** and **FortiManager**, both of which have been exploited in the wild and can lead to full device compromise. In FortiWeb, multiple versions are affected by an unauthenticated SQL injection flaw that lets attackers send crafted HTTP or HTTPS requests to execute unauthorized SQL commands, bypass access controls, read sensitive configuration and user data, alter or delete database records, and potentially escalate to complete system takeover. Fortinet advised customers to upgrade immediately to fixed releases or disable the HTTP/HTTPS management interface as a temporary workaround. In FortiManager, the critical flaw tracked as `CVE-2024-47575` allows unauthenticated remote code execution and remote command execution, with exploitation observed globally and against Finnish organizations. A successful attack can give intruders control of vulnerable FortiManager systems and expose connected device configuration data and passwords. Fortinet issued patches for most affected branches, while **FortiManager Cloud 6.4** has no fix and must be upgraded; the company also warned that if exploitation is suspected, patching alone is insufficient and organizations should perform a full incident investigation using Fortinet’s compromise-assessment guidance.
Jun 29, 2026
Truesec reported that attackers exploited FortiGate FortiCloud SSO vulnerabilities **`CVE-2025-59718`** and **`CVE-2025-59719`** to gain unauthorized administrative access to vulnerable firewalls, provided FortiCloud SSO was enabled and the management interface was reachable. Using a valid FortiCloud account, the attackers generated a malicious SAML assertion accepted by the device, allowing them to take control of the firewall and extract its configuration. Investigations found the stolen configurations contained high-value secrets, including **SSL VPN credentials** and **Active Directory integration accounts**, which attackers used to modify VPN policies and NAT behavior, scan internal networks, exfiltrate data, and deploy ransomware through the **Domain Controller**. Truesec also described a technique in which attackers loaded a stolen configuration onto a controlled FortiGate device and downgraded FortiOS so stored passwords were re-encrypted with a weaker scheme, enabling rapid recovery of plaintext credentials and accelerating lateral movement toward full domain compromise.
Jun 29, 2026