Loading story…
Fortra disclosed a critical insecure-default vulnerability in FileCatalyst Workflow affecting version 5.1.6 Build 139 and earlier, tracked as CVE-2024-6633 with a CVSS 9.8 rating. The flaw exposes the product’s default HSQL database to remote attackers because default configuration credentials were publicly disclosed, allowing access to a service typically reachable on TCP port 4406.
Attackers who reach the database can create an administrative account in the web application and ultimately take full control of the vulnerable FileCatalyst Workflow instance. Fortra and CSIRT.SK advised organizations to upgrade to FileCatalyst Workflow 5.1.7 or later and to avoid using the default database in production by migrating the application to a supported external database platform.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK reported that CVE-2024-6633 is a critical vulnerability with a CVSS score of 9.8 affecting Fortra FileCatalyst Workflow 5.1.6 Build 139 and earlier. The notice reiterated that attackers could use exposed default HSQL database credentials to create an administrative account and recommended upgrading to version 5.1.7 or later and avoiding the default database in production.
Fortra published advisory FI-2024-011 for an insecure default vulnerability in FileCatalyst Workflow 5.1.6 Build 139 and earlier. The issue allows remote attackers to access the default HSQL database and potentially gain full control of the web application.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed two critical vulnerabilities affecting **FortiWeb** and **FortiManager**, both of which have been exploited in the wild and can lead to full device compromise. In FortiWeb, multiple versions are affected by an unauthenticated SQL injection flaw that lets attackers send crafted HTTP or HTTPS requests to execute unauthorized SQL commands, bypass access controls, read sensitive configuration and user data, alter or delete database records, and potentially escalate to complete system takeover. Fortinet advised customers to upgrade immediately to fixed releases or disable the HTTP/HTTPS management interface as a temporary workaround. In FortiManager, the critical flaw tracked as `CVE-2024-47575` allows unauthenticated remote code execution and remote command execution, with exploitation observed globally and against Finnish organizations. A successful attack can give intruders control of vulnerable FortiManager systems and expose connected device configuration data and passwords. Fortinet issued patches for most affected branches, while **FortiManager Cloud 6.4** has no fix and must be upgraded; the company also warned that if exploitation is suspected, patching alone is insufficient and organizations should perform a full incident investigation using Fortinet’s compromise-assessment guidance.
Jun 29, 2026
A critical authentication bypass vulnerability in **Fortra GoAnywhere MFT** allows unauthenticated attackers to create a new administrative user by directly accessing the ` /InitialAccountSetup.xhtml ` endpoint. Tracked as **`CVE-2024-0204`**, the flaw stems from improper path normalization and affects versions earlier than **7.4.1**. Public reporting said most observed internet-exposed instances were still running vulnerable releases, raising the risk of opportunistic compromise. Fortra and defenders urged organizations to upgrade immediately to **GoAnywhere MFT 7.4.1 or later**. As a temporary mitigation for non-containerized deployments, administrators were advised to remove the vulnerable setup page and restart services: ```bash rm -f $GOANYWHERE_INSTALL_DIR/adminroot/WEB-INF/classes/com/linoma/ga/ui/admin/InitialAccountSetup.xhtml ``` The issue was identified by Mohammed Eldeeb and Islam Elrfai of Spark Engineering Consultants, and technical analysis showed the bug could be abused to regain access to an initialization workflow that should no longer be reachable after first-time setup.
Jul 24, 2026
Attackers have been actively targeting internet-exposed **Fortinet FortiGate** management interfaces to seize administrative control of firewalls, with reporting tying the activity to exploitation of **`CVE-2024-55591`** and a related authentication weakness, **`CVE-2025-24472`**. Fortinet said the primary flaw affects **FortiOS** and **FortiProxy** and stems from improper authentication in the Node.js websocket module, allowing an unauthenticated remote attacker to obtain **super-admin** access and full control of vulnerable devices. Observed intrusions included the creation of new administrator accounts, adding those accounts to **SSL VPN** groups, changing firewall policies, and using the compromised appliances to pivot into networks that were otherwise protected behind the VPN perimeter. Security guidance accompanying the disclosures urged organizations to apply Fortinet patches immediately, disable or restrict public exposure of management interfaces, harden FortiOS devices, and review logs for signs of compromise tied to the broader campaign against exposed firewall consoles.
Jul 24, 2026