Attackers exploiting CVE-2024-47575 on one FortiManager took running configs for more than 500 managed FortiGate firewalls, Unit 42 reports. Patching the manager does not retire the credentials and private keys in that archive.
Perspective Coverage
5 publishers
- Builder
- Builder 30%
- Operator
- Operator 60%
- Investor
- Investor 10%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence70
The FBI and Secret Service warned Tuesday that FortiBleed is still scanning Fortinet firewalls and SSL VPN gateways with 86,644 stolen credentials. Patching and a password reset will not clear it.
Perspective Coverage
10 publishers
- Builder
- Builder 22%
- Operator
- Operator 69%
- Investor
- Investor 9%
Reality
- Evidence72
- Adoption62
- Hype gap+25
- Incentives40
- Confidence68
buildOne report1 publisher Outsourced Fortinet firewalls turn ACSC's rotate-everything advice into an ownership question
Australia's ACSC told Fortinet users on 18 June to rotate all admin and VPN credentials immediately, the first of six steps in its alert. On hosted or co-managed gateways, each step first needs someone to settle who holds the accounts and who has to act.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence40
buildOne report1 publisher ACSC's Fortinet credential advisory leaves teams sizing exposure from internet scan counts
ACSC flagged credential attacks on Fortinet gateways with no CVE or version list, so scans counting 983,996 FortiGate assets are the sizing fallback. A certificate-key filter narrows the count to 254,801 but cannot show which admin logins face the internet.
Reality
- Evidence45
- Adoption65
- Hype gap+5
- Incentives
- Not scored
- Confidence45
buildOne report1 publisher FortiOS blocks central NAT while a single policy still references a VIP
Moving an ASA or PAN-OS rulebase onto a FortiGate means picking the NAT model on an empty appliance, because the toggle that gives back one shared NAT table is gated on every VIP and IP pool reference in the policy set.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap−5
- Incentives30
- Confidence58
A single Group Policy Object delivered the whole extortion stage at a Middle East manufacturer
Kaspersky's responders found no encrypted files and no malware on disk across the Windows estate of a Middle East manufacturer in April 2026. The impact arrived through one Group Policy Object linked at the domain root.
Reality
- Evidence62
- Adoption35
- Hype gap+12
- Incentives72
- Confidence58
CVE-2026-24858 let attackers log into Fortinet devices registered to other customers
Fortinet switched off FortiCloud SSO worldwide on January 26 and turned it back on the next day with server-side changes. Devices already fully patched against the two 2025 SAML bypasses were compromised anyway.
Reality
- Evidence70
- Adoption66
- Hype gap−8
- Incentives40
- Confidence65