Attackers exploiting CVE-2024-47575 on one FortiManager took running configs for more than 500 managed FortiGate firewalls, Unit 42 reports. Patching the manager does not retire the credentials and private keys in that archive.
Perspective Coverage
5 publishers
- Builder
- Builder 30%
- Operator
- Operator 60%
- Investor
- Investor 10%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence70
OpenAI is reportedly in early talks to buy Trail of Bits, with no price disclosed. Crypto Briefing reported that CrowdStrike fell about 3% to around $254 on Oct. 14, Palo Alto about 4% and Fortinet more than 3%.
Perspective Coverage
5 publishers
- Builder
- Builder 24%
- Operator
- Operator 26%
- Investor
- Investor 50%
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+30
- Incentives
- Not scored
- Confidence55
The FBI and Secret Service warned Tuesday that FortiBleed is still scanning Fortinet firewalls and SSL VPN gateways with 86,644 stolen credentials. Patching and a password reset will not clear it.
Perspective Coverage
10 publishers
- Builder
- Builder 22%
- Operator
- Operator 69%
- Investor
- Investor 9%
Reality
- Evidence72
- Adoption62
- Hype gap+25
- Incentives40
- Confidence68
Fortinet says attackers are exploiting a CVSS 9.8 unauthenticated file-write flaw in FortiMail, and no fixed release has shipped yet. Until builds arrive, its two workarounds are the only protection, including for 7.2 users told to move to a 7.4 branch that is still unpatched.
Perspective Coverage
10 publishers
- Builder
- Builder 10%
- Operator
- Operator 82%
- Investor
- Investor 8%
Reality
- Evidence78
- Adoption30
- Hype gap+8
- Incentives40
- Confidence76
FortiGuard Labs says the ClingSTUN Linux backdoor exploits two dozen flaws in a dozen vendors' gear and carries seven more to spread itself. Exploitation is indiscriminate, so any reachable vulnerable device on those lists, Ivanti's included, can join its proxy pool.
Perspective Coverage
3 publishers
- Builder
- Builder 33%
- Operator
- Operator 57%
- Investor
- Investor 10%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence58
buildOne report1 publisher Patching FortiMail leaves the reboot-surviving ld.so.preload backdoor in place on exposed appliances
Fortinet confirmed a 9.8-rated, unauthenticated file-write zero-day in FortiMail that attackers are using to drop a reboot-surviving ld.so.preload rootkit. Patching closes the hole but leaves any implant already on the appliance in place.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence55
Meta confirmed it is letting go of the Virtue AI safety team it hired in June, ending the arrangement after four months. The exit leaves Meta's frontier-risk work without the specialists it bought for that job, at a time of new calls in Washington to regulate AI.
Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 39%
- Investor
- Investor 38%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+15
- Incentives60
- Confidence60
buildOne report1 publisher Outsourced Fortinet firewalls turn ACSC's rotate-everything advice into an ownership question
Australia's ACSC told Fortinet users on 18 June to rotate all admin and VPN credentials immediately, the first of six steps in its alert. On hosted or co-managed gateways, each step first needs someone to settle who holds the accounts and who has to act.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence40
Cyera's $1 billion Oasis deal puts a price on one of the AI risks in Anthropic's leaked S-1
Anthropic's leaked S-1 warns AI could resist shutdown or game tests, and only agent-control startups have found acquirers, Cyera paying $1 billion for Oasis. Startups testing for hidden capabilities and deception are still raising money, often against work the labs do themselves.
Publishers:cbinsights.com
Reality
- Evidence35
- Adoption35
- Hype gap+10
- Incentives55
- Confidence35
Fortinet says the Mirai-derived botnet bolts a SOCKS5 relay onto compromised routers, cameras and Confluence hosts. Sellable proxy capacity changes what you hunt for.
Perspective Coverage
5 publishers
- Builder
- Builder 25%
- Operator
- Operator 63%
- Investor
- Investor 12%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence65
More than 100 companies signed a call for collective action on cyber defence whose first principle is that status quo security will not be enough, a sentence co-signed by five of the vendors who supply that status quo.
Perspective Coverage
5 publishers
- Builder
- Builder 33%
- Operator
- Operator 42%
- Investor
- Investor 25%
Reality
- Evidence70
- Adoption20
- Hype gap+35
- Incentives80
- Confidence65
buildOne report1 publisher ACSC's Fortinet credential advisory leaves teams sizing exposure from internet scan counts
ACSC flagged credential attacks on Fortinet gateways with no CVE or version list, so scans counting 983,996 FortiGate assets are the sizing fallback. A certificate-key filter narrows the count to 254,801 but cannot show which admin logins face the internet.
Reality
- Evidence45
- Adoption65
- Hype gap+5
- Incentives
- Not scored
- Confidence45
CISA says all four are under active exploitation, and three of them are unauthenticated flaws in edge and management appliances. Its own alert cites BOD 26-04 and prints no due date for any of them.
Perspective Coverage
4 publishers
- Builder
- Builder 14%
- Operator
- Operator 80%
- Investor
- Investor 6%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence70
Orkes Conductor evaluates workflow expressions on a GraalVM context with the sandbox disabled, and Fortinet blocked about 1,300 exploitation attempts against CVE-2026-58138 over two days in September.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence68
buildOne report1 publisher FortiOS blocks central NAT while a single policy still references a VIP
Moving an ASA or PAN-OS rulebase onto a FortiGate means picking the NAT model on an empty appliance, because the toggle that gives back one shared NAT table is gated on every VIP and IP pool reference in the policy set.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap−5
- Incentives30
- Confidence58
buildOne report1 publisher Conductor OSS runs a stranger's inline JavaScript as root in its default container
An unauthenticated POST to the Conductor Workflow API registers a definition whose inline expression evaluates in a GraalVM context with host access enabled, and the default image runs that process as root. Empirical Security logged attempts in August.
Reality
- Evidence58
- Adoption34
- Hype gap+14
- Incentives62
- Confidence46
CVE-2026-24858 let attackers log into Fortinet devices registered to other customers
Fortinet switched off FortiCloud SSO worldwide on January 26 and turned it back on the next day with server-side changes. Devices already fully patched against the two 2025 SAML bypasses were compromised anyway.
Reality
- Evidence70
- Adoption66
- Hype gap−8
- Incentives40
- Confidence65
SE Labs has been running full attack chains against five vendors' products since July
The PIVOT program was announced on September 15 with Broadcom, CrowdStrike, Fortinet, Palo Alto Networks and Sophos signed up, and the first comparative results are due in January 2027. MITRE's rival test drew 11 vendors in 2025.
Reality
- Evidence42
- Adoption35
- Hype gap+40
- Incentives72
- Confidence45
Open staging directory documents a CVE-2024-21762 intrusion at Thai carrier 3BB
Hunt.io says a threat actor left 298 files in an open directory in Thailand, including FortiGate and F5 exploit scripts written for 3BB and a MeshCentral backdoor that the cleanup script checked was still running.
Reality
- Evidence55
- Adoption30
- Hype gap+18
- Incentives60
- Confidence50
A crafted email is already getting root on unpatched Cisco Secure Email Gateways
CVE-2026-76461 is under active exploitation, hits every physical and virtual Secure Email Gateway whatever its configuration, and has no workaround. CISA gave federal civilian agencies until September 17 to install the fixed builds.
Reality
- Evidence72
- Adoption55
- Hype gap0
- Incentives60
- Confidence68