Hackers Allegedly Selling Fortinet FortiGate 1-Day Vulnerability on Underground Forums
An unverified underground listing offers a claimed FortiGate SSL VPN RCE exploit for FortiOS 7.2.x/7.4.x amid ongoing exploitation of known Fortinet flaws.
Dark Web Intelligence shared an advertisement for a private '1-day' remote code execution exploit targeting FortiGate SSL VPN appliances on FortiOS 7.2.x and 7.4.x, with a claimed proof-of-concept video but no CVE, firmware builds, or technical details. The listing coincides with confirmed in-the-wild exploitation of CVE-2025-25249, an unauthenticated heap-based buffer overflow patched in January 2026 but exploited since July 2026, and CVE-2024-21762, a critical out-of-bounds write in the FortiOS and FortiProxy SSL VPN component. Fortinet has advised disabling SSL VPN where immediate upgrades are not possible.
- Seller claims a PoC video and private-pricing RCE exploit for initial access against exposed SSL VPN services.
- No CVE, affected builds, or technical details provided; could be a new flaw, patched bug, or fraud.
- CVE-2025-25249 heap overflow was patched January 2026 but exploited in real attacks since July 2026.
- CVE-2024-21762 out-of-bounds write in SSL VPN continues to be abused against exposed FortiGate systems.
- Vendors
- Fortinet
- Organizations
- Dark Web Intelligence
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-21762 | Out-of-Bounds Write RCE in Fortinet FortiOS and FortiProxy | 9.8 | 85% | KEVRansomware | KEV |
| CVE-2025-25249 | Heap-Based Buffer Overflow in Fortinet FortiOS, FortiSwitchManager, and FortiSASE | 9.8 | 4% | KEVPoC | KEV |
From the original article
2 min read at cybersecuritynews.com
A threat actor is allegedly offering a private remote code execution exploit for Fortinet FortiGate SSL VPN appliances, claiming that FortiOS 7. 2. x and 7.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.