Loading story…
Forcepoint disclosed a security policy bypass vulnerability in its Security Engine for next-generation firewalls, tracked as CVE-2026-12974. The Canadian Centre for Cyber Security issued advisory AV26-960 covering the issue, although its notice did not provide a severity rating, technical details, indicators of compromise, or evidence of active exploitation.
Affected releases include Forcepoint Security Engine (NGFW) versions 7.1.0 through 7.1.13, 7.3.0 through 7.3.1, 7.3.3, 7.4.0 through 7.4.1, and 7.5.0. Organizations using these versions should review Forcepoint's advisory and apply vendor-provided updates as they become available.
Map this exposure pattern across your cloud, code, and identities.
1 event from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security published advisory AV26-960 for a security-policy-bypass vulnerability in Forcepoint Security Engine (NGFW), identified by Forcepoint as CVE-2026-12974. The advisory lists affected releases 7.1.0–7.1.13, 7.3.0–7.3.1, 7.33, 7.4.0–7.4.1, and 7.5.0, and advises administrators to review Forcepoint guidance and apply updates when available.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcesupport.forcepoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Fortinet disclosed **CVE-2026-70468**, a high-severity authentication bypass flaw in **FortiManager** and **FortiManager Cloud** that could let an unauthenticated remote attacker gain improper access to vulnerable systems. The issue is tracked as **CWE-288** and carries a **CVSS v3.1 score of 8.1**. Affected versions include FortiManager and FortiManager Cloud `7.6.1`, `7.4.3` through `7.4.5`, and `7.2.5` through `7.2.9`, and Fortinet has directed customers to install fixed releases and vendor patches. A related **Canadian Centre for Cyber Security** notice, **AV26-812**, said multiple Fortinet products are affected, naming **FortiClientWindows**, **FortiManager**, and **FortiManager Cloud** across several version branches. The advisory did not publish exploit details, but urged administrators to review Fortinet PSIRT and FortiGuard guidance and apply updates as they become available, underscoring the need for rapid patching across exposed management infrastructure.
Aug 12, 2026
Fortinet disclosed **CVE-2026-24858**, a **critical authentication bypass** (CVSS 9.8, **CWE-288: Alternate Authentication Path**) affecting Fortinet products that support *FortiCloud SSO*. When FortiCloud SSO is enabled, an attacker with a **FortiCloud account** and a **registered device** can potentially authenticate to **other organizations’ devices** registered to different FortiCloud accounts, effectively bypassing expected administrative authentication controls. Fortinet reported **in-the-wild exploitation** prior to patch availability, attributing activity to **two attacker-controlled FortiCloud accounts** that were subsequently blocked. Impacted versions include **FortiAnalyzer** (7.0.0–7.0.15, 7.2.0–7.2.11, 7.4.0–7.4.9, 7.6.0–7.6.5), **FortiManager** (7.0.0–7.0.15, 7.2.0–7.2.11, 7.4.0–7.4.9, 7.6.0–7.6.5), and **FortiOS** (7.0.0–7.0.18, 7.2.0–7.2.12, 7.4.0–7.4.10, 7.6.0–7.6.5), with fixed releases available in the corresponding patched branches. Recommended actions include **urgent patching**, **disabling FortiCloud SSO where feasible**, and reviewing authentication/audit logs for anomalous FortiCloud SSO login activity.
Jun 29, 2026
Fortinet disclosed multiple critical vulnerabilities in **FortiOS** and related products, including an authentication bypass in **FortiOS** and **FortiProxy** that can grant attackers **super-admin privileges** and is being **actively exploited in the wild**. The flaw can be triggered through specially crafted requests to the **Node.js websocket module** and affects FortiOS `7.0.0` through `7.0.16`, FortiProxy `7.2.0` through `7.2.12`, and FortiProxy `7.0.0` through `7.0.19`. Organizations were told to upgrade to FortiOS `7.0.17+`, FortiProxy `7.2.13+`, or FortiProxy `7.0.20+`, and to apply Fortinet’s recommended mitigations immediately. Separate Fortinet advisories also warned of critical flaws **CVE-2024-21762** and **CVE-2024-23113**, affecting **FortiOS, FortiProxy, FortiPAM, and FortiSwitchManager**. **CVE-2024-21762** carries a **CVSS 9.6** rating, while **CVE-2024-23113** is rated **CVSS 9.8**; both require urgent patching to fixed versions identified by Fortinet. Fortinet and national cyber authorities said defenders should prioritize upgrades across exposed appliances, and for `CVE-2024-21762`, disabling the **SSL VPN** feature can reduce exposure until patches are applied.
Jun 29, 2026