U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Fortinet FortiSandbox and Microsoft SharePoint flaws to its Known Exploited Vulnerabilities catalog.
CVE-2026-25089 (CVSS score of 9.8) Fortinet FortiSandbox OS Command Injection Vulnerability
CVE-2026-39808 (CVSS score of 9.8) Fortinet FortiSandbox OS Command Injection Vulnerability
CVE-2026-58644 (CVSS score of 9.8) Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
This week, Microsoft’s July 2026 Patch Tuesday addressed the SharePoint remote code execution bug CVE-2026-58644, which can be triggered without authentication or user interaction. The flaw stems from the deserialization of untrusted data.
“Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.” reads the advisory. “In a network-based attack, an attacker authenticated as at least a Site Owner, could write arbitrary code to inject and execute code remotely on the SharePoint Server.”
Microsoft confirmed it is aware of active exploitation of this vulnerability.
The second issue added to the KeV catalog is an OS command injection flaw, tracked as CVE-2026-25089, in FortiSandbox products. The vulnerability could allow remote, unauthenticated attackers to send specially crafted HTTP requests and execute arbitrary commands on affected devices. Adham El Karn of Fortinet Product Security team discovered the vulnerability.
The last issue added to the catalog, tracked as CVE-2026-39808, is an OS command injection flaw.
“An Improper Neutralization of Special Elements used in an OS Command (‘OS command injection’) vulnerability [CWE-78] in FortiSandbox may allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.” reads the advisory.
Cybersecurity firm Defused Cyber confirmed it’s seen active exploitation of this vulnerability within a 24-hour window.
FortiBleed exposed valid credentials for 73,000+ Fortinet firewalls, revealing a large-scale access-brokering operation targeting organizations worldwide.
In mid-June 2026, researcher Volodymyr “Bob” Diachenko found a live, exposed server containing working login credentials for tens of thousands of Fortinet firewalls, a data leak code-named FortiBleed. The headline number, valid remote-access logins for 73,932 devices across 21,632 organizations in 194 countries, roughly half of every internet-facing FortiGate on the planet, is what made it news. The server was left open by accident, complete with the tools, logs, scripts, and credential catalog of a running operation.
But a list of stolen passwords is the output of a crime, not the crime itself. Mysterium VPN traced the operation back to a single vendor trading under the handle “SantaAd” on an underground Russian-speaking cybercrime forum.
The account has been building a vendor reputation since early 2025, and its post history reads like a product catalog with one obsession: Fortinet. Over recent months, the same seller auctioned remote-access credentials to named US manufacturers, listed thousands of Fortinet admin panels, and ran a standing advertisement buying fresh corporate access from US companies above a set revenue threshold.
“The single most telling piece of evidence in the whole affair isn’t a password; it’s the spreadsheet.” reads the report published by MysteriumVPN “The leaked data is annotated, organization by organization, with company name, sector, annual revenue, and employee count, and sorted into tiers by how much they’re worth.”
Espionage actors sort targets by intelligence value. This actor sorted them by price. The revenue column is what marks this as a financially motivated operation whose end product is resale — most likely to ransomware crews for whom a pre-validated foothold in a high-revenue company is exactly what they’re buying.
The operation ran on mostly off-the-shelf parts. A dedicated brute-force server generated and tested credential combinations at scale — over a billion device-and-password pairs drawn from a few thousand common starting points, running tens of thousands of simultaneous attempts through rotating proxy addresses. A separate cracking server ran an open-source password-cracking tool fed by a cluster of roughly 45 high-end GPUs rented by the hour. A third workstation handled manual work: writing code, managing seven disposable Kali Linux virtual machines, and navigating victim networks once access was established.
“The custom code carries the fingerprints of machine-generated software — emoji status messages, tidy ‘Step 1 / Step 2 / Step 3’ formatting, verbose explanatory comments, and ties back to an AI code-editor session created days before the campaign began.” continues the report.
The crew also deployed an AI-driven penetration-testing framework: a tool that lets an operator describe an objective in plain language and have software carry out the network attack automatically. Actions that once required a skilled, experienced attacker are now available to anyone who can rent a server and formulate a prompt.
The broker’s own candor is instructive. In one auction thread, when asked where the data came from, the seller said it was “mostly brute” and that the brute-forcing tool was written in-house. When asked how many credentials actually worked, they admitted that only a fraction had been confirmed valid and that the validation tool had broken. At one point an entire auction was pulled because “the dump had errors.” This is what access brokering looks like from the inside: a noisy, imperfect assembly line, not a clean heist.
“When this made the news, the broker didn’t go quiet. They updated a live auction for access to several thousand Fortinet devices, raised the starting price, and cited the news coverage as an authenticity guarantee.” A journalist’s writeup used as a sales testimonial. That’s a first.
The practical takeaway is architectural. The device organizations buy to keep strangers out became the front door a criminal crew walked through and then cataloged. Get the management interface off the public internet, enforce multi-factor authentication on VPN and admin access, some of the cracked credentials in this dataset were long and complex, which proves password strength alone doesn’t save you, and rotate every credential stored in the device configuration. Then assume your organization is already on a shopping list, because if it could appear in this dataset, access to your network may already be for sale.
FortiBleed targeted 430,000+ FortiGate devices, harvesting 110M credentials and enabling breaches through large-scale credential theft.
A new threat intelligence report from SOCRadar’s Threat Research Unit (STRU), the team that first identified and named the FortiBleed campaign, goes deeper than anything published so far on what is shaping up to be one of the most significant credential-theft operations of 2026.
FortiBleed is a large-scale, financially motivated campaign targeting FortiGate firewalls globally. STRU first reported and named the campaign here. The numbers alone are staggering: over 430,000 FortiGate firewalls targeted, more than 110 million credentials identified across 659+ harvesting pipelines, and a confirmed breach of a NATO-aligned defense contractor.
What makes this report different
Most coverage of FortiBleed stops at the headline figures. This report doesn’t.
Starting from a single exposed directory flagged by security researcher Volodymyr “Bob” Diachenko, STRU traced the operation to more than 150 additional servers, building a near-complete picture of the actor’s infrastructure, tooling, and operational workflow. At the time of writing, the campaign is still actively sniffing over 19,000 devices, part of a broader pool of 80,553 identified targets.
That level of visibility is what separates this analysis from others.
A five-phase attack chain, fully reconstructed
The report walks through every stage of the operation in technical detail:
The actor starts with credential sourcing and mass reconnaissance, using Masscan for port sweeps, a custom Shodan_Recon tool for passive enrichment, and a purpose-built FortiProbe-fast binary to filter confirmed FortiGate devices from millions of raw scan results. Targets are then ranked by revenue before any exploitation resources are allocated, a step that reflects deliberate operational planning rather than opportunistic spraying.
Initial access comes through SSH brute-force using 16 wordlists specifically curated for FortiGate admin account naming conventions, alongside credential stuffing against SSL-VPN portals.
The core of the operation is a Golang-based tool called FortigateSniffer, which abuses the legitimate FortiOS diagnostic command diagnose sniffer packet to passively capture authentication traffic across 24 protocols from every compromised device, Kerberos, RADIUS, NTLM, RDP, LDAP, MSSQL, and more, without deploying any malware. The sniffer only runs between 07:00 and 18:00 Moscow Time, a deliberate evasion choice to blend in with normal business-hours traffic.
Captured hashes are cracked through a distributed GPU cluster managed via Hashtopolis, with Hashcat as the underlying engine and a Telegram bot providing live telemetry to a single hardcoded administrator. The actors also rented GPU capacity through vast.ai for additional cracking power.
The final phases cover lateral movement across Active Directory environments and, in at least one confirmed case, the targeted exfiltration of DFS backup data from a NATO-aligned defense contractor, triggered within minutes of Kerberos hashes being cracked offline.
Infrastructure and attribution
The actors operate from a network of loosely regulated Eastern European micro-hosters, with the core infrastructure segmented across four subnet blocks serving distinct roles: C2 aggregation, credential validation, sniffer deployment, and proxy rotation. The pentest lab environment itself runs seven Kali Linux virtual machines under QEMU/KVM, hardened with strict IPTables rules and designed for multi-operator remote access through shared tmux sessions.
Tooling comments in the Cyrillic alphabet suggest Russian origin. The actor profile is consistent with an Initial Access Broker selling access to ransomware groups, though the targeting of a NATO-aligned defense contractor raises the possibility of at least opportunistic collaboration with state-adjacent actors.
Who is being hit
The victim profile skews heavily toward SMBs: roughly 66% of affected organizations have fewer than 200 employees, and nearly 90% have annual revenues below $100 million. India, the United States, and Taiwan account for nearly a third of affected domains. IT services is the most targeted sector, a strategic choice, since compromising a managed service provider creates downstream access paths into customer environments.
The campaign is global and appears opportunistic rather than geopolitically focused, with meaningful victim counts across Latin America, the Middle East, and Europe as well.
What to do now
STRU recommends that organizations potentially in scope immediately rotate all credentials tied to Fortinet VPN and administrative interfaces, enforce MFA, remove FortiGate management interfaces from direct internet exposure, and review authentication logs for anomalous activity. SOCRadar has also released a free FortiBleed exposure checker at socradar.io/free-tools/fortibleed.
The campaign remains active. The full technical report, including the complete MITRE ATT&CK mapping, IoC lists, and infrastructure breakdown, is at socradar.io.
FortiBleed exposed a massive campaign that made billions of login attempts against Fortinet VPNs, compromising organizations worldwide.
FortiBleed wasn’t a targeted hack. It was a factory. A multi-operator crew ran an industrial-scale attack against Fortinet FortiGate SSL VPN devices worldwide, and security researcher Volodymyr “Bob” Diachenko of SecurityDiscovery.com caught them only because they left their own infrastructure exposed on the open internet in June 2026.
“The crew mass-scans 320,777 FortiGate /remote/login endpoints and more than 247,000 Sophos /userportal endpoints. FortiGate logins are then sprayed with 3,639 base credential pairs across every target, 1.16 billion combinations in total, through a custom tool called forticheck running 25,000 threads.” reads the report published by Ransomnews.
A parallel campaign hit 163,650 MSSQL servers with 2.1 billion attempts at 50,000 threads. That’s not espionage; that’s automation.
Once they got in somewhere useful, they dropped network sniffers to pull cleartext credentials from HTTP, FTP, SMTP, LDAP, and other protocols.
“Once inside reachable infrastructure, the operators drop network sniffers that scrape cleartext credentials out of HTTP, FTP, SMTP, POP3, IMAP, LDAP, SNMP, and Telnet traffic.” states the report. “Intercepted Kerberos and NTLM hashes are shipped to a 45-way NVIDIA RTX 4090 cracking cluster orchestrated through Hashtopolis.”
With cracked credentials in hand, they replayed captured session cookies through OpenConnect to hijack live VPN sessions, then walked straight into Active Directory. Standard looting from there: AD dumps, fileshare exfiltration, Kerberos tickets, Group Policy templates.
The operators aren’t random. They work from Kali Linux virtual machines behind NAT so their command server never touches a victim’s Active Directory directly. Targets are ranked by revenue, with a top tier above 113 billion dollars, using open-source intelligence. Multiple operators work the same machines at once, coordinating over shared terminal sessions. The hash-cracking server, tellingly, was left running on default credentials. The same mistake they exploit in victims.
At least four organisations were fully compromised, across Japan, Taiwan, Vietnam, Iraq, and Turkey. The most serious claim involves a Turkish defence contractor with NATO ties whose classified defence documents were exfiltrated. Ransomnews hasn’t independently verified those contents and treats the attribution as the investigator’s assessment, not confirmed fact.
The working dataset covers 73,932 exposed FortiGate devices across 21,613 organisations in 207 countries. India leads on raw volume, and Latin American telecoms carry the densest device fleets. IT services, telecoms, financial services, and government are the most exposed sectors.
“In a random sample of exposed organisations, 88% also appeared in stealer-log or breach data and 38% had staff with active infostealer infections. Around 590 are already named on ransomware leak sites.” concludes the report.”An exposed FortiGate is rarely an isolated problem. It is one visible symptom of an organisation attackers have already found more than once.”
An exposed FortiGate isn’t a standalone problem. It’s a sign that attackers have already found the organisation more than once.
If you run FortiGate, take the management interface and SSL VPN off the public internet wherever possible. Rotate every administrator and local credential, upgrade FortiOS, and invalidate active VPN sessions so replayed cookies stop working. Reset exposed employee credentials too, not just the firewall accounts, because the infostealer overlap is too high to ignore.
The researchers also released a FortiBleed Checker to allow admins to check their domains.
FortiBleed exposed credentials for 74,000 Fortinet devices, with attackers actively exploiting the leak to target systems worldwide.
On June 18, CISA issued an emergency alert after reports surfaced that credentials for approximately 74,000 Fortinet firewalls and VPN gateways had been leaked in what researchers are calling FortiBleed. The agency confirmed that threat actors were actively using those credentials to target internet-accessible Fortinet devices across government and private-sector organizations worldwide.
“CISA is aware of global reports that malicious cyber actors have targeted internet-accessible Fortinet devices across government and private sector organizations using compromised credentials.” reads the alert published by CISA. “This activity, referred to as FortiBleed, involves the exposure of leaked credentials associated with approximately 74,000 Fortinet devices, including firewalls and virtual private network (VPN) gateways.”
This week, the security researcher Bob Diachenko found a server sitting open on the internet containing what appeared to be valid Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords for tens of thousands of organizations. He posted about it on LinkedIn. Kevin Beaumont, one of the most trusted independent voices in network security, then obtained the dataset, worked through it with Hudson Rock, and confirmed what nobody wanted to hear.
“Massive Fortinet/FortiGate bruteforce/active exploitation campaign uncovered in action. Thousands of top vendors instances are listed in the files like this (see screenshot). This one alone has 21,634 domain names – from Chevron to Fortinet itself. All – with potentially working passwords to the FortiGate appliances obtained through various menas.” Bob Diachenko wrote on LinkedIn. “Crooks use sophisticated hashcracking approach to get then plaintext passwords from the Fortigate configs and use them consequently in the internal network movement and takeover.”
The popular cybersecurity expert Kevin Beaumont confirmed that the data is legit and is related to around 75k devices.
“The data is legit. It is around 75k devices. Almost all are still online, and Fortinet devices. It appears to be recent data.” reads the analysis published by Beaumont. “The data appears to have come from exports of config from the devices, as it includes things which are only visible from the device itself.”
Beaumont verified credentials at multiple organizations in the dataset personally and found them working. The IP addresses in this collection are largely different from the 2025 Belsen Group leak, which covered 15,000 devices. That earlier dump was old data from a 2022 zero-day. This one isn’t.
Based on Shodan polling, the FortiBleed dataset covers roughly 50% of all Fortinet firewall devices currently facing the internet.
“In a majority of cases, the Fortigate Management Interface is exposed to the internet on impacted devices.” states the expert.
According to Hudson Rock’s analysis, the 73,932 unique firewall URLs span 194 countries and 21,632 unique domains. Names appearing in the dataset according to Hudson Rock include Foxconn, Samsung, Comcast, Siemens, Lenovo, PwC, Accenture, Oracle, and numerous government agencies and critical infrastructure operators. One entry in Diachenko’s screenshots alone listed 21,634 domain names, including Chevron and Fortinet itself.
Diachenko’s investigation went further after he found the attackers had accidentally left an open directory containing their own tooling, scripts, connection strings, logs, and analytics. What he found inside suggests a Russian-speaking multi-operator threat group conducted approximately 1.16 billion credential attempts against 320,777 FortiGate targets, plus 2.1 billion attempts against 163,650 Microsoft SQL Server systems.
The group reportedly intercepted SSL VPN authentication hashes and cracked them using a 45-GPU cluster managed through Hashtopolis. Multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey were described as fully compromised, including a Turkish NATO defense contractor from which classified documents were allegedly stolen.
The data appears to have come from exported device configurations rather than a simple credential scrape. That’s a meaningful distinction: config exports contain information you can’t get just by intercepting login traffic, which points toward actual device access at some point. How that access was obtained remains unknown: it may be one of the many documented Fortinet CVEs, or it may be something new.
One detail in the dataset that stands out is the business intelligence layer. Each entry includes the company’s industry, revenue, employee count, and country, formatted in a way Beaumont describes as very common in criminal markets for selling initial access. This wasn’t assembled for personal use. It was assembled for sale or coordinated deployment across a team. The attached comments on each target are essentially a sales catalog.
That means an attacker with these credentials can log in remotely, gain access to the firewall and therefore the network behind it, change security settings, and create backdoor admin accounts. Beaumont also noted that Fortinet moved to PBKDF2 credential storage in early 2025 firmware updates, but only for devices where admins had actually logged in after applying the update. Many devices were still storing passwords as SHA-256 with salt, which is crackable via brute force from a stolen config file.
Hudson Rock has published a free lookup tool at hudsonrock.com/fortinet where organizations can check if their domain appears in the dataset.
” It is unclear where Hunt Intelligence obtained the data from and how long it has been in circulation, however it is formatted in a way which looks like an eCrime gang — e.g. it lists the type of company, their revenue and country.” concludes Beaumont. “This is a very common format in eCrime circles when selling initial access information.”
CISA’s instructions are direct and non-negotiable for any organization running Fortinet equipment. Terminate all active SSL VPN and administrative sessions immediately. Reset every VPN and administrative password. Enable phishing-resistant multi-factor authentication on all admin interfaces. Review logs for unauthorized access or lateral movement.
Upgrade to the latest FortiOS release and have every admin log back in to trigger the re-hashing of stored credentials to PBKDF2. Remove the FortiOS management interface from public internet access unless absolutely necessary, and delete any unauthorized accounts.
If you see unexpected successful logins to admin accounts, don’t assume it was a mistake. Assume the device is compromised and consider replacing it, because the attackers may have already modified its configuration or planted backdoor accounts that persist through credential rotation.
FortiBleed: Admin Passwords for 75,000 Fortinet Firewalls Are Out in the Wild. Half the Internet-Facing Fortinets on the Planet.
Security researcher Bob Diachenko found a server sitting open on the internet containing what appeared to be valid Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords for tens of thousands of organizations. He posted about it on LinkedIn. Kevin Beaumont, one of the most trusted independent voices in network security, then obtained the dataset, worked through it with Hudson Rock, and confirmed what nobody wanted to hear.
“Massive Fortinet/FortiGate bruteforce/active exploitation campaign uncovered in action. Thousands of top vendors instances are listed in the files like this (see screenshot). This one alone has 21,634 domain names – from Chevron to Fortinet itself. All – with potentially working passwords to the FortiGate appliances obtained through various menas.” Bob Diachenko wrote on LinkedIn. “Crooks use sophisticated hashcracking approach to get then plaintext passwords from the Fortigate configs and use them consequently in the internal network movement and takeover.”
The popular cybersecurity expert Kevin Beaumont confirmed that the data is legit and is related to around 75k devices.
“The data is legit. It is around 75k devices. Almost all are still online, and Fortinet devices. It appears to be recent data.” reads the analysis published by Beaumont. “The data appears to have come from exports of config from the devices, as it includes things which are only visible from the device itself.”
Beaumont verified credentials at multiple organizations in the dataset personally and found them working. The IP addresses in this collection are largely different from the 2025 Belsen Group leak, which covered 15,000 devices. That earlier dump was old data from a 2022 zero-day. This one isn’t.
Based on Shodan polling, the FortiBleed dataset covers roughly 50% of all Fortinet firewall devices currently facing the internet.
“In a majority of cases, the Fortigate Management Interface is exposed to the internet on impacted devices.” states the expert.
According to Hudson Rock’s analysis, the 73,932 unique firewall URLs span 194 countries and 21,632 unique domains. Names appearing in the dataset according to Hudson Rock include Foxconn, Samsung, Comcast, Siemens, Lenovo, PwC, Accenture, Oracle, and numerous government agencies and critical infrastructure operators. One entry in Diachenko’s screenshots alone listed 21,634 domain names, including Chevron and Fortinet itself.
Diachenko’s investigation went further after he found the attackers had accidentally left an open directory containing their own tooling, scripts, connection strings, logs, and analytics. What he found inside suggests a Russian-speaking multi-operator threat group conducted approximately 1.16 billion credential attempts against 320,777 FortiGate targets, plus 2.1 billion attempts against 163,650 Microsoft SQL Server systems.
The group reportedly intercepted SSL VPN authentication hashes and cracked them using a 45-GPU cluster managed through Hashtopolis. Multiple organizations across Japan, Taiwan, Vietnam, Iraq, and Turkey were described as fully compromised, including a Turkish NATO defense contractor from which classified documents were allegedly stolen.
The data appears to have come from exported device configurations rather than a simple credential scrape. That’s a meaningful distinction: config exports contain information you can’t get just by intercepting login traffic, which points toward actual device access at some point. How that access was obtained remains unknown: it may be one of the many documented Fortinet CVEs, or it may be something new.
One detail in the dataset that stands out is the business intelligence layer. Each entry includes the company’s industry, revenue, employee count, and country, formatted in a way Beaumont describes as very common in criminal markets for selling initial access. This wasn’t assembled for personal use. It was assembled for sale or coordinated deployment across a team. The attached comments on each target are essentially a sales catalog.
That means an attacker with these credentials can log in remotely, gain access to the firewall and therefore the network behind it, change security settings, and create backdoor admin accounts. Beaumont also noted that Fortinet moved to PBKDF2 credential storage in early 2025 firmware updates, but only for devices where admins had actually logged in after applying the update. Many devices were still storing passwords as SHA-256 with salt, which is crackable via brute force from a stolen config file.
Hudson Rock has published a free lookup tool at hudsonrock.com/fortinet where organizations can check if their domain appears in the dataset.
” It is unclear where Hunt Intelligence obtained the data from and how long it has been in circulation, however it is formatted in a way which looks like an eCrime gang — e.g. it lists the type of company, their revenue and country.” concludes Beaumont. “This is a very common format in eCrime circles when selling initial access information.”
For any organization that finds itself in the data: rotate admin credentials immediately, check for unexpected successful logins to admin accounts, upgrade to the latest FortiOS and have admins log back in to trigger the credential storage upgrade, disable internet-facing management interfaces, and enforce multi-factor authentication on all admin users.
Three FortiSandbox flaws, including one patched last week, are being actively exploited, highlighting the shrinking window for defenders.
Cybersecurity firm Defused Cyber confirmed it’s seen active exploitation of three vulnerabilities in Fortinet FortiSandbox within a 24-hour window. Two of them had patches sitting available since April. The third got fixed last week, which, apparently, wasn’t fast enough.
We are observing exploitation of multiple Fortinet FortiSandbox vulnerabilities during the past 24 hours, including:
CVE-2026-39813 (no previous recorded exploitation) CVE-2026-39808 CVE-2026-25089 (vibecoded, likely faulty exploit)
CVE-2026-39813 (CVSS score: 9.1) is a path traversal vulnerability in FortiSandbox JRPC API that could allow an unauthenticated attacker to bypass authentication via specially crafted HTTP requests. Its twin, CVE-2026-39808 (CVSS score of 9.8), carries the same severity score and is an OS command injection flaw, same attack vector, same result: unauthenticated code execution via crafted HTTP requests. Both had patches available for two months.
The third flaw, CVE-2026-25089, hits a broader surface. Fortinet described it as an operating system command injection impacting FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS WEB UI that could allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. The patch dropped last week, yet it’s already being used in the wild.
“An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS WEB UI may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.” reads the advisory.
Here’s where it gets interesting. The exploit for CVE-2026-25089 appears to have been built with AI assistance, and it shows, not in a good way. Defused Cyber researchers speculate that the exploit for CVE-2026-25089 not only shows signs of being developed using an artificial intelligence (AI) model, but is also bugged. A working exploit for the vulnerability has not been publicly disclosed. So attackers are throwing broken AI-generated code at unpatched systems and still finding traction. That should tell you something about the state of patch management out there.
Fortinet gear keeps drawing this kind of attention. In April, the company pushed out-of-band patches for a critical flaw in FortiClient EMS, tracked as CVE-2026-35616, (CVSS score of 9.1) which was already being exploited before the fix arrived. If you run anything in the Fortinet stack, the window between disclosure and active exploitation has become uncomfortably short. Patch cycles measured in weeks are now measured in days.
Entrar
We are observing exploitation of multiple Fortinet FortiSandbox vulnerabilities during the past 24 hours, including: