PSA: upgrade your FortiOS devices, they’re hiding a zero day again.
December 21, 2024 at 12:06 AM
PSA: upgrade your FortiOS devices, they’re hiding a zero day again.
Fortinet warned today that attackers are exploiting another authentication bypass zero-day bug in FortiOS and FortiProxy to hijack Fortinet firewalls and breach enterprise networks.
Fortinet warns of new zero-day exploited to hijack firewalls
Fortinet warned today that attackers are exploiting another authentication bypass zero-day bug in FortiOS and FortiProxy to hijack Fortinet firewalls and breach enterprise networks.
www.bleepingcomputer.com
February 11, 2025 at 6:56 PM
Fortinet warned today that attackers are exploiting another authentication bypass zero-day bug in FortiOS and FortiProxy to hijack Fortinet firewalls and breach enterprise networks.
FortiOS Vulnerability Allows Super-Admin Privilege Escalation – Patch Now! hackread.com/fortios-vuln...
FortiOS Vulnerability Allows Super-Admin Privilege Escalation – Patch Now!
Follow us on Bluesky, Twitter (X) and Facebook at @Hackread
hackread.com
February 13, 2025 at 3:52 PM
FortiOS Vulnerability Allows Super-Admin Privilege Escalation – Patch Now! hackread.com/fortios-vuln...
Fortinet、「FortiGate」用OS「FortiOS 7.6.3」からSSL VPNトンネルモードのサポートを終了へ
https://atmarkit.itmedia.co.jp/ait/articles/2504/28/news053.html
https://atmarkit.itmedia.co.jp/ait/articles/2504/28/news053.html
Fortinet、「FortiGate」用OS「FortiOS 7.6.3」からSSL VPNトンネルモードのサポートを終了へ
Fortinetは、同社のファイアウォール「FortiGate」に搭載するOS「FortiOS」の最新バージョン「FortiOS 7.6.3」から、「SSL VPNトンネルモード」のサポートを終了すると発表した。
atmarkit.itmedia.co.jp
April 28, 2025 at 9:46 AM
Fortinet、「FortiGate」用OS「FortiOS 7.6.3」からSSL VPNトンネルモードのサポートを終了へ
https://atmarkit.itmedia.co.jp/ait/articles/2504/28/news053.html
https://atmarkit.itmedia.co.jp/ait/articles/2504/28/news053.html
Step into the decryption rhythm with our latest blog! 💃 We're moving through Fortinet's FortiOS 7.0.x firmware, revealing secrets hidden in the ChaCha20 algorithm. Stay in step as we detail how we did it.
Decrypting Fortinet's FortiOS 7.0.x | GreyNoise Blog
Curious about decrypting Fortinet's FortiOS 7.0.x firmware? In the latest Grimoire post, we delve into the technical details of doing just that, revealing a hardcoded key used in the ChaCha20 encrypti...
www.greynoise.io
April 23, 2024 at 10:45 PM
Step into the decryption rhythm with our latest blog! 💃 We're moving through Fortinet's FortiOS 7.0.x firmware, revealing secrets hidden in the ChaCha20 algorithm. Stay in step as we detail how we did it.
CyberSecurity News - Article -
"FortiOS and FortiSwitchManager Vulnerability Let Remote Attackers Execute Arbitrary Code"...
cybersecuritynews.com/fortios-and-...
==========================
#librecanada #linux #opensource
"FortiOS and FortiSwitchManager Vulnerability Let Remote Attackers Execute Arbitrary Code"...
cybersecuritynews.com/fortios-and-...
==========================
#librecanada #linux #opensource
FortiOS and FortiSwitchManager Vulnerability Let Remote Attackers Execute Arbitrary Code
Fortinet has disclosed a critical heap-based buffer overflow vulnerability (CWE-122) in the cw_acd daemon of FortiOS and FortiSwitchManager.
cybersecuritynews.com
January 16, 2026 at 4:04 AM
CyberSecurity News - Article -
"FortiOS and FortiSwitchManager Vulnerability Let Remote Attackers Execute Arbitrary Code"...
cybersecuritynews.com/fortios-and-...
==========================
#librecanada #linux #opensource
"FortiOS and FortiSwitchManager Vulnerability Let Remote Attackers Execute Arbitrary Code"...
cybersecuritynews.com/fortios-and-...
==========================
#librecanada #linux #opensource
Perimeter Under Pressure: Analyzing the Latest Microsoft, FortiOS, and PAN-OS Zero-Days
Expert analysis of the September 2026 vulnerability landscape, focusing on critical zero-days in Microsoft, FortiOS, and PAN-OS that threaten network perimeters
#Vulnerability #Microsoft
Read more →
Expert analysis of the September 2026 vulnerability landscape, focusing on critical zero-days in Microsoft, FortiOS, and PAN-OS that threaten network perimeters
#Vulnerability #Microsoft
Read more →
Perimeter Under Pressure: Analyzing the Latest Microsoft, FortiOS, and PAN-OS Zero-Days
Expert analysis of the September 2026 vulnerability landscape, focusing on critical zero-days in Microsoft, FortiOS, and PAN-OS that threaten network perimeters
calmvibez.com
September 21, 2026 at 12:53 PM
Perimeter Under Pressure: Analyzing the Latest Microsoft, FortiOS, and PAN-OS Zero-Days
Expert analysis of the September 2026 vulnerability landscape, focusing on critical zero-days in Microsoft, FortiOS, and PAN-OS that threaten network perimeters
#Vulnerability #Microsoft
Read more →
Expert analysis of the September 2026 vulnerability landscape, focusing on critical zero-days in Microsoft, FortiOS, and PAN-OS that threaten network perimeters
#Vulnerability #Microsoft
Read more →
Fortinet has warned customers that threat actors are still actively exploiting a critical FortiOS vulnerability that allows them to bypass two-factor authentication (2FA) when targeting vulnerable FortiGate firewalls.
Fortinet warns of 5-year-old FortiOS 2FA bypass still exploited in attacks
Fortinet has warned customers that threat actors are still actively exploiting a critical FortiOS vulnerability that allows them to bypass two-factor authentication (2FA) when targeting vulnerable FortiGate firewalls.
www.bleepingcomputer.com
December 29, 2025 at 11:16 AM
Fortinet has warned customers that threat actors are still actively exploiting a critical FortiOS vulnerability that allows them to bypass two-factor authentication (2FA) when targeting vulnerable FortiGate firewalls.
Looks good, currently running FortiOS 7.0.12 so first order of business is to upgrade it to 7.0.15. According to the FortiOS Version Upgrade Path tool I first have to upgrade to 7.0.14 and then to 7.0.15. Easy enough.
June 7, 2024 at 2:56 PM
Looks good, currently running FortiOS 7.0.12 so first order of business is to upgrade it to 7.0.15. According to the FortiOS Version Upgrade Path tool I first have to upgrade to 7.0.14 and then to 7.0.15. Easy enough.
At #XFD15, Chris Hinsz of Fortinet is talking about FortiOS 8.0. I can remember the first time I worked with the Fortigate upgrading them from FortiOS 2.6 to FortiOS 2.8!
April 29, 2026 at 4:04 PM
At #XFD15, Chris Hinsz of Fortinet is talking about FortiOS 8.0. I can remember the first time I worked with the Fortigate upgrading them from FortiOS 2.6 to FortiOS 2.8!
Fortinet、5 年前の FortiOS SSL VPN の脆弱性が特定の構成下で悪用されていることを報告
#CybersecurityNews
securityaffairs.com/186117/secur...
#CybersecurityNews
securityaffairs.com/186117/secur...
Five-year-old Fortinet FortiOS SSL VPN flaw actively exploited
Fortinet reported active exploitation of a five-year-old FortiOS SSL VPN flaw, abused in the wild under specific configurations.
securityaffairs.com
December 25, 2025 at 11:11 PM
Fortinet、5 年前の FortiOS SSL VPN の脆弱性が特定の構成下で悪用されていることを報告
#CybersecurityNews
securityaffairs.com/186117/secur...
#CybersecurityNews
securityaffairs.com/186117/secur...
Fortinet FortiOS Authentication Bypass (CVE-2024-55591 ) : labs.watchtowr.com/get-fortirek...
January 29, 2025 at 12:48 PM
Fortinet FortiOS Authentication Bypass (CVE-2024-55591 ) : labs.watchtowr.com/get-fortirek...
CVE-2025-67862 - Fortinet FortiOS/FortiProxy Unsafe Debug Access for Lua Script Execution
CVE ID : CVE-2025-67862
Published : June 9, 2026, 4:16 p.m. | 20 minutes ago
Description : An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] v...
CVE ID : CVE-2025-67862
Published : June 9, 2026, 4:16 p.m. | 20 minutes ago
Description : An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] v...
CVE-2025-67862 - Fortinet FortiOS/FortiProxy Unsafe Debug Access for Lua Script Execution
An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 through 7.4.7, FortiOS 7.2.0 through 7.2.10, FortiOS 7.0.0 through 7.0.16, FortiOS 6.4 all versions, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0 …
cvefeed.io
June 9, 2026 at 5:44 PM
CVE-2025-67862 - Fortinet FortiOS/FortiProxy Unsafe Debug Access for Lua Script Execution
CVE ID : CVE-2025-67862
Published : June 9, 2026, 4:16 p.m. | 20 minutes ago
Description : An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] v...
CVE ID : CVE-2025-67862
Published : June 9, 2026, 4:16 p.m. | 20 minutes ago
Description : An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] v...
📖 New from endoflife.ai:
FortiOS 7.4 End of Support: May 11, 2027 and November 11, 2028
https://endoflife.ai/article-fortios-74-eol
FortiOS 7.4 End of Support: May 11, 2027 and November 11, 2028
https://endoflife.ai/article-fortios-74-eol
September 19, 2026 at 5:48 PM
📖 New from endoflife.ai:
FortiOS 7.4 End of Support: May 11, 2027 and November 11, 2028
https://endoflife.ai/article-fortios-74-eol
FortiOS 7.4 End of Support: May 11, 2027 and November 11, 2028
https://endoflife.ai/article-fortios-74-eol
this is why your org needs a network security engineer - and a test network to validate firmware updates, so they can be applied, quickly, and with confidence
my services are available for such an endeavor
cybersecuritynews.com/cisa-fortine...
my services are available for such an endeavor
cybersecuritynews.com/cisa-fortine...
CISA Warns of Fortinet FortiOS Authentication Bypass Vulnerability Exploited in Wild
CISA has issued a critical security alert highlighting a significant vulnerability in Fortinet's FortiOS and FortiProxy systems, which threat actors are actively exploiting.
cybersecuritynews.com
March 19, 2025 at 5:24 PM
this is why your org needs a network security engineer - and a test network to validate firmware updates, so they can be applied, quickly, and with confidence
my services are available for such an endeavor
cybersecuritynews.com/cisa-fortine...
my services are available for such an endeavor
cybersecuritynews.com/cisa-fortine...
In FortiOS und FortiProxy klaffen mehrere Sicherheitslücken. Unter anderem können Angreifer Admin-Cookies klauen und damit Zugriff erlangen. #Security
Fortinet liefert Updates: Admin-Cookie-Klau in FortiOS und FortiProxy möglich
In FortiOS und FortiProxy klaffen mehrere Sicherheitslücken. Unter anderem können Angreifer Admin-Cookies klauen und damit Zugriff erlangen.
www.heise.de
April 10, 2024 at 5:46 AM
In FortiOS und FortiProxy klaffen mehrere Sicherheitslücken. Unter anderem können Angreifer Admin-Cookies klauen und damit Zugriff erlangen. #Security
FortiOSに脆弱性見つかる度に「お前んとこ使ってないだろな？」って質問が来て面倒。
August 2, 2023 at 8:19 AM
FortiOSに脆弱性見つかる度に「お前んとこ使ってないだろな？」って質問が来て面倒。
Fortinet has released security updates to address two critical vulnerabilities in FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager that could allow attackers to bypass FortiCloud SSO authentication.
Fortinet warns of critical FortiCloud SSO login auth bypass flaws
Fortinet has released security updates to address two critical vulnerabilities in FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager that could allow attackers to bypass FortiCloud SSO authentication.
www.bleepingcomputer.com
December 9, 2025 at 6:37 PM
Fortinet has released security updates to address two critical vulnerabilities in FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager that could allow attackers to bypass FortiCloud SSO authentication.
Belsen hackers leaked 15,000+ FortiGate configs (passwords, keys, VPNs) via CVE-2022-40684. Affected FortiOS 7.0.0-7.0.6/7.2.0-7.2.2 users MUST change credentials immediately. 1.6GB data dump on dark web.#FortiGateDataLeak
January 16, 2025 at 3:07 AM
Belsen hackers leaked 15,000+ FortiGate configs (passwords, keys, VPNs) via CVE-2022-40684. Affected FortiOS 7.0.0-7.0.6/7.2.0-7.2.2 users MUST change credentials immediately. 1.6GB data dump on dark web.#FortiGateDataLeak
U.S. CISA adds Fortinet FortiOS/FortiProxy and GitHub Action flaws to its Known Exploited Vulnerabilities catalog
U.S. CISA adds Fortinet FortiOS/FortiProxy and GitHub Action flaws to its Known Exploited Vulnerabilities catalog
U.S. CISA adds Fortinet FortiOS/FortiProxy and GitHub Action flaws to its Known Exploited Vulnerabilities catalog.
securityaffairs.com
March 19, 2025 at 8:44 AM
U.S. CISA adds Fortinet FortiOS/FortiProxy and GitHub Action flaws to its Known Exploited Vulnerabilities catalog
Our test is based on the methodology published by watchTowr:
github.com/watchtowrlab... - thank you!
CVE-2024-55591 vulnerability tracker: dashboard.shadowserver.org/statistics/c...
Fortinet advisory: fortiguard.com/psirt/FG-IR-...
Make sure to check for signs of compromise!
github.com/watchtowrlab... - thank you!
CVE-2024-55591 vulnerability tracker: dashboard.shadowserver.org/statistics/c...
Fortinet advisory: fortiguard.com/psirt/FG-IR-...
Make sure to check for signs of compromise!
fortios-auth-bypass-check-CVE-2024-55591/CVE-2024-55591-check.py at main · watchtowrlabs/fortios-auth-bypass-check-CVE-2024-55591
Contribute to watchtowrlabs/fortios-auth-bypass-check-CVE-2024-55591 development by creating an account on GitHub.
github.com
January 20, 2025 at 12:42 PM
Our test is based on the methodology published by watchTowr:
github.com/watchtowrlab... - thank you!
CVE-2024-55591 vulnerability tracker: dashboard.shadowserver.org/statistics/c...
Fortinet advisory: fortiguard.com/psirt/FG-IR-...
Make sure to check for signs of compromise!
github.com/watchtowrlab... - thank you!
CVE-2024-55591 vulnerability tracker: dashboard.shadowserver.org/statistics/c...
Fortinet advisory: fortiguard.com/psirt/FG-IR-...
Make sure to check for signs of compromise!
🚨CVE-2024-55591: Fortinet FortiOS Authentication Bypass Proof of Concept
Link: github.com/watchtowrlab...
Website post: darkwebinformer.com/cve-2024-555...
Link: github.com/watchtowrlab...
Website post: darkwebinformer.com/cve-2024-555...
January 27, 2025 at 8:19 PM
🚨CVE-2024-55591: Fortinet FortiOS Authentication Bypass Proof of Concept
Link: github.com/watchtowrlab...
Website post: darkwebinformer.com/cve-2024-555...
Link: github.com/watchtowrlab...
Website post: darkwebinformer.com/cve-2024-555...