Loading story…
Fortinet disclosed CVE-2023-25610, a critical buffer-underwrite flaw in the HTTP/HTTPS administrative interface of FortiOS and FortiProxy. A remote, unauthenticated attacker can send crafted requests to execute arbitrary code on vulnerable appliances; certain additional Fortinet products may be susceptible to denial-of-service conditions.
A public proof of concept was released shortly after the advisory, increasing the risk of exploitation. Organizations should immediately apply Fortinet’s updates and, where patching cannot occur promptly, restrict or disable internet-exposed HTTP/HTTPS administrative access. Wiz reported that 9% of cloud enterprise environments were exposed and that 80% of surveyed FortiOS-using environments had not yet patched.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
A public proof of concept was published for CVE-2023-25610, increasing the likelihood that the vulnerability would be exploited in the wild.
Fortinet issued an advisory for CVE-2023-25610, a critical buffer-underwrite vulnerability in FortiOS and FortiProxy administrative interfaces that can permit unauthenticated remote code execution through crafted requests.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed multiple critical vulnerabilities in **FortiOS** and related products, including an authentication bypass in **FortiOS** and **FortiProxy** that can grant attackers **super-admin privileges** and is being **actively exploited in the wild**. The flaw can be triggered through specially crafted requests to the **Node.js websocket module** and affects FortiOS `7.0.0` through `7.0.16`, FortiProxy `7.2.0` through `7.2.12`, and FortiProxy `7.0.0` through `7.0.19`. Organizations were told to upgrade to FortiOS `7.0.17+`, FortiProxy `7.2.13+`, or FortiProxy `7.0.20+`, and to apply Fortinet’s recommended mitigations immediately. Separate Fortinet advisories also warned of critical flaws **CVE-2024-21762** and **CVE-2024-23113**, affecting **FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager**. **CVE-2024-21762** carries a **CVSS 9.6** rating, while **CVE-2024-23113** is rated **CVSS 9.8**; both require urgent patching to fixed versions identified by Fortinet. Fortinet and national cyber authorities said defenders should prioritize upgrades across exposed appliances, and for `CVE-2024-21762`, disabling the **SSL VPN** feature can reduce exposure until patches are applied.
Jun 29, 2026
Attackers began exploiting **Fortinet authentication bypass flaw** `CVE-2022-40684` against internet-facing devices shortly after the vulnerability was disclosed, according to SOC observations. The issue affects **FortiOS**, **FortiProxy**, and **FortiSwitchManager**, and allows unauthenticated attackers to send crafted HTTP/HTTPS requests that bypass authentication and gain access to the administrative interface. Observed attacks started within days of disclosure, with defenders warning that public proof-of-concept code could accelerate broader exploitation. Organizations were urged to **upgrade affected versions immediately** or apply Fortinet’s mitigations, including disabling HTTP/HTTPS administrative access where possible and restricting administrative interface access to trusted IP addresses.
Aug 15, 2026
Fortinet patched multiple vulnerabilities in **FortiOS** and **FortiProxy**, led by critical captive-portal flaws `CVE-2023-42789` (out-of-bounds write) and `CVE-2023-42790` (stack-based buffer overflow). Devices with captive portal enabled could be exposed to arbitrary code or command execution through specially crafted HTTP requests; Fortinet rated the flaws CVSS 9.3 and reported no known exploitation when the advisory was issued. The updates also address `CVE-2024-23112`, an SSL VPN web-mode bookmark authorization bypass that lets an authenticated user manipulate a URL to access another user's bookmark, and `CVE-2023-46717`, which can elevate a read-only user's privileges to read-write where FortiAuthenticator is deployed in high-availability mode. Organizations should upgrade affected FortiOS and FortiProxy installations to Fortinet's fixed releases promptly, prioritizing internet-facing systems and appliances using captive portals. Until patching is complete, Fortinet recommends disabling form-based authentication schemes to mitigate the captive-portal RCE flaws, disabling SSL VPN web mode to mitigate bookmark exposure, and disabling FortiToken Mobile push notifications in FortiAuthenticator RADIUS policies for affected HA deployments. FortiSASE 23.3.b already includes fixes for the two captive-portal vulnerabilities.
Aug 31, 2026