Loading story…
Fortinet patched CVE-2024-47575, a critical FortiManager zero-day in the fgfmd API that allows unauthenticated attackers to inject commands, execute arbitrary code, access sensitive data, and potentially take control of FortiManager and managed devices. The flaw carries a CVSS 9.8 rating, and Fortinet said it had already warned customers and issued temporary mitigation guidance before releasing fixed versions for FortiManager and FortiManager Cloud.
Mandiant reported that the vulnerability was exploited in the wild from at least June 27, 2024, with mass exploitation observed in October and more than 50 potentially compromised internet-exposed FortiManager appliances identified across multiple industries. The activity, tracked as UNC5820 and also referenced by Fortinet as FG-IR-24-423, involved staging and exfiltrating configuration data from managed FortiGate devices, including detailed appliance configurations and FortiOS256-hashed user passwords; defenders were urged to upgrade immediately, restrict administrative exposure, tighten access controls, and review logs and published indicators of compromise.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Mandiant publicly reported that the FortiManager zero-day exploitation was linked to a newly tracked threat cluster, UNC5820. It also warned that stolen configuration data could support further compromise and lateral movement, although no such follow-on activity had yet been observed.
In October 2024, Mandiant and Fortinet investigated mass exploitation of FortiManager appliances and identified more than 50 potentially compromised devices across multiple industries. Attackers staged and exfiltrated configuration data from managed FortiGate devices, including appliance configurations and FortiOS256-hashed user passwords.
Fortinet released fixes for the critical FortiManager zero-day CVE-2024-47575, a missing authentication flaw in the fgfmd API that can enable unauthenticated command injection and code execution. The company recommended immediate upgrades to fixed FortiManager and FortiManager Cloud versions.
Fortinet had been warning customers about the FortiManager vulnerability and providing temporary mitigation guidance since 2024-10-13. The guidance preceded the availability of patched versions.
Mandiant observed exploitation of CVE-2024-47575 as early as 2024-06-27. The activity was later attributed to the newly tracked threat cluster UNC5820.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed active exploitation of **CVE-2024-47575**, a critical `CVSS 9.8` vulnerability in FortiManager and FortiManager Cloud. A remote unauthenticated attacker can send a specially crafted command to execute arbitrary code and take control of a vulnerable FortiManager appliance; public proof-of-concept exploit code was available. Attackers can abuse a valid FortiGate certificate to register an unauthorized device, potentially exposing managed network configurations and VPN information. Fortinet issued additional fixes after determining that its initial remediation could leave previously compromised environments exposed through a trusted device; affected organizations should apply the latest patches and mitigations, investigate for prior compromise using supplied indicators, and reset accounts and renew certificates where compromise is identified.
Aug 31, 2026
Fortinet disclosed two critical vulnerabilities affecting **FortiWeb** and **FortiManager**, both of which have been exploited in the wild and can lead to full device compromise. In FortiWeb, multiple versions are affected by an unauthenticated SQL injection flaw that lets attackers send crafted HTTP or HTTPS requests to execute unauthorized SQL commands, bypass access controls, read sensitive configuration and user data, alter or delete database records, and potentially escalate to complete system takeover. Fortinet advised customers to upgrade immediately to fixed releases or disable the HTTP/HTTPS management interface as a temporary workaround. In FortiManager, the critical flaw tracked as `CVE-2024-47575` allows unauthenticated remote code execution and remote command execution, with exploitation observed globally and against Finnish organizations. A successful attack can give intruders control of vulnerable FortiManager systems and expose connected device configuration data and passwords. Fortinet issued patches for most affected branches, while **FortiManager Cloud 6.4** has no fix and must be upgraded; the company also warned that if exploitation is suspected, patching alone is insufficient and organizations should perform a full incident investigation using Fortinet’s compromise-assessment guidance.
Jun 29, 2026
Attackers have been actively targeting internet-exposed **Fortinet FortiGate** management interfaces to seize administrative control of firewalls, with reporting tying the activity to exploitation of **`CVE-2024-55591`** and a related authentication weakness, **`CVE-2025-24472`**. Fortinet said the primary flaw affects **FortiOS** and **FortiProxy** and stems from improper authentication in the Node.js websocket module, allowing an unauthenticated remote attacker to obtain **super-admin** access and full control of vulnerable devices. Observed intrusions included the creation of new administrator accounts, adding those accounts to **SSL VPN** groups, changing firewall policies, and using the compromised appliances to pivot into networks that were otherwise protected behind the VPN perimeter. Security guidance accompanying the disclosures urged organizations to apply Fortinet patches immediately, disable or restrict public exposure of management interfaces, harden FortiOS devices, and review logs for signs of compromise tied to the broader campaign against exposed firewall consoles.
Jul 24, 2026