ThreatsDay: Fortinet fixes, PHP2Shell scans, Authenticator token flaw
Fortinet is withholding flaw details until November 10 while Hudson Rock reports 40,573 exposed FortiGate secrets.
64
Product
FortiOS
- Mentions · 7d4
- Mentions · 30d20
- All mentions33
- First seenAug 12, 2026
- Last mentioned1d ago
Timeline
33 articles · newest firstFortiBleed 2.0 finds 40,573 cleartext secrets in FortiGate configs
Hudson Rock parsed 1,703 FortiGate configuration reports and 1,689 host identifiers; 975 domain labels were absent from the earlier set.
58
FortiBleed 2.0 finds 40,573 cleartext secrets in exposed FortiGate configs
The follow-up is stolen configuration files, not a new Fortinet flaw, and the records are not confirmed still valid.
66
Fortinet patches critical FortiOS flaws, details held to November 10
Fixes cover FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator; Fortinet says public diffs will show attackers where to look.
72
Canadian centre flags Fortinet flaws in six product lines (AV26-1081)
Fixed builds are listed for current branches, while FortiMail 7.2 must move to branch 7.4 or above.
36
Fortinet schedules critical fixes for FortiOS, FortiManager, and FortiAnalyzer
Minimum fixed builds are set for October 22, while PSIRT advisories and CVE details are due November 10.
70
PAN-OS and Panorama affected by unpatched PHP2Shell flaws
Palo Alto has no fixed PAN-OS builds yet; Fortinet is still checking 12 products and Cisco 31 products and services.
74
Fortinet urges urgent patches for FortiOS, FortiManager and FortiAnalyzer
October 22 updates precede November 10 PSIRT advisories; Fortinet reports no active exploitation and lists no CVE IDs.
74
UNC5820 used Fortinet zero-days to plant PeerStitch at a telecom
CISA added CVE-2025-61624 to KEV; the memory-only implant rides legitimate FortiGate process traffic.
84
U.S. CISA adds Fortinet Multiple Products and BeyondTrust Remote Support flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Fortinet and BeyondTrust flaws to KEV, with a federal fix deadline of October 19.
88
PEERSTITCH malware: How Attackers Compromised 500 Firewalls Through FortiManager
Unit 42 says PEERSTITCH, planted through FortiManager flaws, exposed material for more than 500 firewalls.
82
PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions
Unit 42 says CL-STA-0954 used Fortinet flaws to deploy memory-resident PEERSTITCH against a telecom provider.
84
CISA lists Fortinet path traversal CVE-2025-61624 as exploited
Authenticated admins with read-write rights can write or delete arbitrary files via CLI; the due date is October 19, 2026.
76
New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory
Unit 42 details PEERSTITCH, a memory-resident implant used against FortiGate firewalls at a telecom MSP.
80
Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Attackers exploited Fortinet flaws at a telecom MSP and deployed the stealthy PEERSTITCH implant on FortiGate firewalls.
82
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
Unit 42 says UNC5820 stole data on 500-plus FortiGates and deployed memory-resident PEERSTITCH malware.
84
Double free in signal handler
A double-free in FortiOS, FortiProxy, and FortiSwitch lets a local user crash the newcli daemon.
24
GUI Denial of Service
Fortinet discloses a CVSS 6.7 FortiOS flaw that can crash the HTTPS management interface.
48
September 2026 CVE Landscape
Recorded Future says 80 vulnerabilities were actively exploited in September 2026, including NetScaler zero-days.
85
FortiBleed Attack Campaign Exploiting Fortinet Firewalls and VPNs – FBI Warns
FBI warns FortiBleed compromised over 86,000 Fortinet firewalls and VPNs in 194 countries.
88
Hackers Allegedly Selling Fortinet FortiGate 1-Day Vulnerability on Underground Forums
An unverified underground listing offers a claimed FortiGate SSL VPN RCE exploit for FortiOS 7.2.x/7.4.x amid ongoing exploitation of known Fortinet flaws.
64
U.S. CISA adds Cisco, Google Chromium V8, Fortinet, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog
CISA added actively exploited Cisco FMC, Chrome V8, Fortinet and Citrix NetScaler flaws to its KEV catalog, ordering federal patching by September 12.
84
CISA Warns of Fortinet Heap-based Buffer Overflow Flaw Exploited in Attacks
CISA added actively exploited Fortinet CVE-2025-25249, a critical heap-based buffer overflow in FortiOS, FortiSwitchManager, and FortiSASE, to its KEV catalog.
85
CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
CISA adds actively exploited Cisco, Citrix, and Fortinet edge-device flaws to KEV catalog, ordering federal agencies to patch by September 12, 2026.
85
Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks
Threat actors exploit Fortinet heap-based buffer overflow CVE-2025-25249 to deploy PivotC2 RAT, infecting 178 devices and exfiltrating data from US targets.
82
Fortinet security advisory (AV26-023) - Update 1
CISA added Fortinet CVE-2025-25249, a heap-based buffer overflow in the cw_acd daemon, to its KEV catalog; Canadian Cyber Centre urges patching.
60
Fortinet Patches Critical Vulnerabilities in FortiMonitorOnSight, Chrome Extension
Fortinet patched 10 vulnerabilities including two critical authentication flaws, CVE-2026-84390 (CVSS 9.6) and CVE-2026-84388 (CVSS 9.1), in FortiMonitorOnSight and the FortiPAM Chrome extension.
58
Fortinet security advisory (AV26-898)
Canadian Cyber Centre advisory AV26-898 flags Fortinet vulnerabilities across FortiOS, FortiProxy, FortiPAM, FortiSandbox and FortiMonitorOnSight, urging administrators to apply updates
26
Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT
SOCRadar says attackers exploit FortiGate CVE-2025-25249 to deploy the PivotC2 Node.js RAT, compromising 178 of 30,000 targeted devices and stealing credentials.
72
Fortinet Vulnerability Ransomware
Ransomware operators are exploiting a Fortinet vulnerability, per the Infosecurity Magazine headline; article details unavailable.
73
Gunra Ransomware Exploits Fortinet FortiOS, FortiProxy Flaws to Breach Networks
CISA, FBI, and South Korean agencies warn Gunra ransomware, with 51 victims since April 2025, exploits Fortinet flaws for double-extortion attacks on critical infrastructure.
76
UI DoS attack
FortiOS web interface is vulnerable to unauthenticated slow HTTP denial-of-service attacks via crafted requests (CVSS 5.0).
20
Stack buffer overflow in WAD
FortiOS explicit proxy WAD daemon stack buffer overflow (CVSS 5.1) allows code execution only with Kerberos and SOCKS configured.
24
Related CVEs
by mentions- CVE-2025-252494%9.8Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE
- CVE-2025-616241%6.5Authenticated path traversal in Fortinet FortiOS and related products
- CVE-2024-4757595%9.8Unauthenticated RCE in Fortinet FortiManager and FortiManager Cloud
- CVE-2026-2007988%10.0Authentication bypass to root access in Cisco Secure Firewall Management Center
- CVE-2026-1949033%9.3Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2024-26009<1%8.1An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16…
- CVE-2024-26008<1%5.3An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version…
- CVE-2025-47855<1%9.8An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 through 7.0.1, FortiFone 3.0.13 through…
Appears with
- Fortinetvendor · 33
- FortiManagerproduct · 13
- FortiGateproduct · 13
- FortiSwitchManagerproduct · 10
- CISAorganization · 9
- FortiProxyproduct · 8
- PeerStitchmalware · 7
- FortiAnalyzerproduct · 6
- CL-STA-0954threat actor · 6
- Palo Alto Networksorganization · 6
- UNC5820threat actor · 6
- FortiPAMproduct · 5
- Unit 42organization · 5
- PivotC2malware · 4
- Ciscovendor · 4
- FortiAuthenticatorproduct · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.