Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
Merged summary · from the lead articleSummaries by Vani AI
Exploited Fortinet Bug Linked to Stealthy FortiGate Implant in Telecom Hack
A suspected state-sponsored threat actor exploited multiple Fortinet vulnerabilities in an attack against a telecommunications organization, Palo Alto Networks reports. The intrusion, attributed to UNC5820 (tracked by Palo Alto Networks as CL-STA-0954), occurred in September 2024 and resulted in long-term access to the victim’s environment. Initial access was obtained through the exploitation of…
- CVEs
- CVE-2024-47575CVE-2025-61624CVE-2024-26008CVE-2026-102764CVE-2026-1731CVE-2023-46805CVE-2024-21887CVE-2025-0282CVE-2023-4966CVE-2026-22769
- Products
- FortiOSFortiManagerBeyondTrust Remote SupportPrivileged Remote AccessBomgarCitrix NetScalerIvanti Connect SecureDell RecoverPoint for Virtual MachinesBeyondTrust
- Organizations
- CISAPalo Alto NetworksMandiantBeyondTrustGoogle Threat Intelligence GroupGoogleCanadian Centre for Cyber SecuritySOCRadar
- Countries
- United StatesChinaCanada
Coverage
oldest first · one row per article · UTC- · 14d ago
Infosecurity MagazineFirst report
China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns
Google says China-linked Armory Castle exploited critical BeyondTrust flaw CVE-2026-102764 and retained root on appliances.
- · 14d ago
CSO Online
BeyondTrust zero-day tied to Chinese spies puts Remote Support users on alert
Chinese espionage group Armory Castle exploited BeyondTrust Remote Support zero-day CVE-2026-102764 for root and credential-vault access.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-21887+1 related CVE | Command Injection RCE in Ivanti Connect Secure and Policy Secure | 9.1 group max | 100% | KEVRansomwarePoC | KEV |
| CVE-2023-4966 | Info-Disclosure Buffer Overflow (CitrixBleed) in Citrix NetScaler ADC/Gateway | 7.5 | 100% | KEVRansomware | KEV |
| CVE-2024-26008 | An improper check or handling of exceptional conditions vulnerability [CWE-703] in FortiOS version 7.4.0 through 7.4.3 and before 7.2.7, FortiProxy version… | 5.3 | <1% | ||
| CVE-2024-47575 | Unauthenticated RCE in Fortinet FortiManager and FortiManager Cloud | 9.8 | 95% | KEVPoC | KEV |
| CVE-2025-0282 | Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways | 9.0 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2025-61624 | Authenticated path traversal in Fortinet FortiOS and related products | 6.5 | 1% | KEV | KEV |
| CVE-2026-102764 | Message-origin spoofing enables file ops on BeyondTrust Remote Support | 9.3 | 19% | KEVPoC ×2 | KEV |
| CVE-2026-1731 | Pre-Authentication OS Command Injection RCE in BeyondTrust Remote Support and PRA | 9.9 | 93% | KEVRansomwarePoC | KEV |
| CVE-2026-22769 | Hard-coded credentials in Dell RecoverPoint for Virtual Machines allow root OS access | 10.0 | 14% | KEV | KEV |