FortiManager template injection can grant super admin on FortiGates
Fortinet rates the command-injection path CVSS 8.4; the notice does not name versions, fixes or active attacks.
Stories per day · 30 days
3 RSS
Relatedfortimanager5fortinet5peerstitch4unc58204cve-2024-475753cve-2025-616243credential-exposure2credential-theft2fortios2fortiweb2globalprotect2k0t2active-directory1edge-devices1hudson-rock1infostealer1kev1ldap1
24 stories, newest first · one card per story
Stories tagged #fortigate
FortiBleed 2.0 finds 40,573 cleartext secrets in FortiGate configs
Hudson Rock parsed 1,703 FortiGate configuration reports and 1,689 host identifiers; 975 domain labels were absent from the earlier set.
FortiBleed 2.0 finds 40,573 cleartext secrets in exposed FortiGate configs
The follow-up is stolen configuration files, not a new Fortinet flaw, and the records are not confirmed still valid.
k0t steals credentials from FortiGate, FortiWeb and GlobalProtect
Group-IB reports more than 70,000 exposed credentials and active use of CVE-2025-64446 and CVE-2026-0257.
Operators hit FortiGate, FortiWeb and GlobalProtect to steal stored passwords
Group-IB and NyxLab tie the edge-device campaign to k0t and report more than 70,000 exposed credentials.
UNC5820 used Fortinet zero-days to plant PeerStitch at a telecom
CISA added CVE-2025-61624 to KEV; the memory-only implant rides legitimate FortiGate process traffic.
New PEERSTITCH Malware Targets FortiGate Firewalls and Hides Inside System Memory
Unit 42 details PEERSTITCH, a memory-resident implant used against FortiGate firewalls at a telecom MSP.
9
Hackers Exploit Fortinet Vulnerabilities to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Attackers exploited Fortinet flaws at a telecom MSP and deployed the stealthy PEERSTITCH implant on FortiGate firewalls.
14
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
Unit 42 says UNC5820 stole data on 500-plus FortiGates and deployed memory-resident PEERSTITCH malware.
4
FBI: FortiBleed attackers can lock organizations out of their own firewalls
FBI says FortiBleed operators hit over 80,000 FortiGate devices and can lock victims out of firewalls.
1
FBI, Secret Service add to warnings of FortiBleed credential stealing campaign
FBI and Secret Service say FortiBleed compromised over 86,000 Fortinet firewalls in 194 countries.
4
PAYLOAD Ransomware Hijacks Active Directory GPO to Disrupt Entire Windows Domain Without Encryption
PAYLOAD ransomware crew hijacked Active Directory GPOs to disrupt a Middle East manufacturer's entire Windows domain without encrypting files.
1
PAYLOAD Ransomware Abuses Active Directory Group Policy to Disrupt Entire Windows Domain
PAYLOAD ransomware abused Active Directory Group Policy to disrupt a Windows domain without using file encryption.
2
Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
Kaspersky details PAYLOAD ransomware operators abusing Active Directory GPOs for encryptionless extortion at a Middle East manufacturer, exfiltrating data published on the dark web.
2
Hackers Allegedly Selling Fortinet FortiGate 1-Day Vulnerability on Underground Forums
An unverified underground listing offers a claimed FortiGate SSL VPN RCE exploit for FortiOS 7.2.x/7.4.x amid ongoing exploitation of known Fortinet flaws.
3
Thai Broadband Provider Hacked via Fortinet Vulnerability
Hackers exploited Fortinet CVE-2024-21762 RCE to breach Thai broadband provider 3BB, deploying MeshCentral backdoors and credential-harvesting tools across its network.
Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor
Threat actors exploited FortiOS SSL-VPN flaw CVE-2024-21762 to breach Thai ISP Triple T Broadband, gaining root-level persistence via MeshCentral agents.
3
3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials
Hunt.io found an attacker holding root access inside Thai ISP 3BB via a MeshCentral backdoor, targeting subscriber RADIUS credential databases.
Hackers Exploit FortiGate SSL-VPN Vulnerability to Attack Broadband Provider
Exposed attacker staging server reveals intrusion of Thai broadband provider 3BB via actively exploited FortiGate SSL-VPN flaw CVE-2024-21762.
8
Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories
Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.
Hackers Exploit Critical FortiGate Flaw to Deploy AI-Assisted PivotC2 RAT
SOCRadar says attackers exploit FortiGate CVE-2025-25249 to deploy the PivotC2 Node.js RAT, compromising 178 of 30,000 targeted devices and stealing credentials.
4
Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware
Attackers actively exploit CVE-2025-25249 in FortiGate firewalls to deploy PivotC2, a Node.js RAT that decrypts VPN and admin credentials.
3
CVE-2025-25249 Exploitation Delivers PivotC2, a FortiGate Post-Exploitation RAT
Attackers exploiting CVE-2025-25249 in Fortinet FortiGate firewalls deploy PivotC2, a post-exploitation RAT, on exposed edge devices.
2
FGFM Authentication Weakening via CLI Configuration
FortiManager FGFM flaw (CVSS 7.3) lets an attacker with a valid certificate impersonate any managed FortiGate under a specific CLI option.