tag: Fortinet · 9 items
- Engineer — Act: FortiSandbox unauthenticated command injection is CISA KEV-listed with EPSS 0.76 and a public PoC — patch to the vendor-issued fixed version immediately, or isolate the appliance from untrusted network access if patching cannot be done within your window.
- SOC/IR — Act: With a public PoC and active exploitation implied by KEV listing, hunt for anomalous outbound connections or unexpected process execution from FortiSandbox hosts; check for command injection attempts in appliance logs since the CVE disclosure date.
- Leader — Plan: This is a critical edge-appliance RCE at the active-exploitation threshold, but it is a routine patch-and-remediate event unless your org runs FortiSandbox — confirm with engineering whether it is in scope and verify remediation is on track.
- Signals: CVE-2026-25089 — CISA KEV: listed, EPSS 0.76, public PoC on GitHub
- Engineer — Act: Active exploitation of CVE-2025-61624 on FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager is confirmed; patch all affected Fortinet products immediately and audit edge device logs for signs of PEERSTITCH deployment.
- SOC/IR — Act: Memory-resident malware on edge devices evades most endpoint controls — assume compromise if Fortinet appliances are in scope; hunt for anomalous outbound traffic or process anomalies on FortiOS devices and sweep for PEERSTITCH IOCs published with this campaign.
- Leader — Plan: Advanced actor activity against widely deployed Fortinet edge infrastructure warrants confirming this quarter whether all Fortinet appliances are patched and whether incident response runbooks cover memory-resident implants on network devices.
- Signals: CVE-2025-61624 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Act: FortiGate firewalls and SSL VPN gateways are common enterprise edge devices; an active FBI-warned campaign locking out admins signals credential theft or config tampering at scale. Audit all FortiGate admin accounts for unauthorized additions or password changes, verify firmware is at latest patched version, and review admin-access logs from at least the past 30 days.
- SOC/IR — Act: Admin lockout is a concrete post-exploitation TTP indicating attackers have achieved privileged access to edge devices before defenders can respond. Hunt for unauthorized admin account creation or privilege changes on FortiGate devices since October 2026, and initiate assume-breach review of any network segments fronted by affected appliances.
- Leader — Act: An FBI advisory on a named, ongoing campaign against a widely-deployed enterprise VPN product warrants immediate internal exposure check. Confirm whether your environment runs FortiGate, get a status report from the network team this week, and be prepared to brief leadership on containment posture if exposure is confirmed.
- Engineer — Act: FBI/USSS joint advisory confirms active harvesting against internet-facing FortiGate and SSL VPN devices via reused credentials and legacy SHA-256 password storage. Immediately rotate all Fortinet admin and VPN credentials, disable SHA-256 legacy password configs, and enforce MFA on management interfaces.
- SOC/IR — Act: The campaign’s scale and active status mean affected devices may already be compromised before patching. Sweep authentication logs for anomalous VPN logins and lateral movement since campaign onset; apply assume-breach posture for any internet-exposed FortiGate or SSL VPN in your estate.
- Leader — Act: A joint FBI/Secret Service advisory citing 86,000+ harvested credentials from widely-deployed network perimeter devices is board-question territory. Confirm whether Fortinet FortiGate or SSL VPN is in use, request an exposure assessment from the infrastructure team, and prepare a brief for leadership before they read this in the news.
- Engineer — Act: CISA KEV listed, public PoC available, and active exploitation confirmed — patch FortiMail to Fortinet’s recommended fixed version immediately; treat any unpatched internet-facing FortiMail instance as potentially compromised.
- SOC/IR — Act: Active zero-day exploitation of a network-edge email gateway warrants an assume-breach posture — sweep FortiMail logs for anomalous command execution or outbound connections since the first reported exploitation date, and tune detections for post-compromise activity on devices in that network segment.
- Leader — Act: Confirm whether your organization runs FortiMail and verify emergency patching is underway; CISA KEV listing on an actively exploited edge appliance may warrant a brief to leadership given potential for email interception and lateral movement.
- Signals: CVE-2026-104286 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: CISA KEV-listed, public PoC exists, and active exploitation confirmed — unauthenticated arbitrary file write on FortiMail (CVSS 9.8). Identify all FortiMail instances and apply Fortinet’s patch immediately; treat unpatched appliances as potentially compromised.
- SOC/IR — Act: Active exploitation of an internet-facing email gateway means assume-breach posture for any unpatched FortiMail appliance; hunt for anomalous file creation events and unexpected processes spawned from the FortiMail service since the KEV listing date.
- Leader — Plan: A KEV-listed critical on email gateway infrastructure warrants confirming with engineering this week that all FortiMail deployments are inventoried and on the emergency patch queue — not board-level systemic risk, but email compromise has compliance and data-exposure implications worth tracking.
- Signals: CVE-2026-104286 — CISA KEV: listed, EPSS 0.02, public PoC on GitHub, reported by 2 collected sources
- Engineer — Act: Fortinet and Schneider Electric products are named as actively exploited entry points in a joint US/South Korea advisory; audit Fortinet appliances and OT-facing Schneider devices for unpatched vulnerabilities and apply vendor patches immediately.
- SOC/IR — Act: Joint government advisory signals published TTPs and IOCs are available; run a Gunra hunt across network and endpoint telemetry now, prioritizing environments in healthcare, financial services, or government sectors given the stated targeting pattern.
- Leader — Act: A US/South Korea joint advisory naming specific critical-infrastructure sectors—healthcare, financial, government—warrants same-week action: confirm whether Fortinet or Schneider Electric products are in your estate and brief leadership before this appears in industry news.
- Engineer — Act: FortiSandbox is actively exploited per CISA KEV listing with a public PoC on GitHub; patch to the fixed version immediately and check for signs of compromise on any internet-facing FortiSandbox appliances.
- SOC/IR — Act: KEV listing plus public PoC means exploitation is likely underway; hunt for anomalous outbound connections or new processes spawned from FortiSandbox hosts since the PoC publication date, and check edge appliance logs for unauthenticated command-injection attempts.
- Leader — Plan: KEV-listed Fortinet RCE warrants confirming whether FortiSandbox is in the environment and requesting patch status from the infrastructure team; brief on remediation timeline if deployed, given the active exploitation signal.
- Signals: CVE-2026-25089 — CISA KEV: listed, EPSS 0.36, public PoC on GitHub
- Engineer — Act: CISA KEV listing with active exploitation means patch FortiSandbox to the vendor-fixed version immediately — treat this as a critical-priority change with a days-level window, not weeks.
- SOC/IR — Act: Active exploitation of FortiSandbox warrants an assume-breach sweep on any FortiSandbox instances in the estate; hunt for anomalous outbound connections or config changes on those appliances since the vulnerability window opened.
- Leader — Act: Confirm whether FortiSandbox is deployed anywhere in your environment, verify the patching timeline with your engineering team, and be prepared to brief leadership if you are a federal agency facing CISA’s Sunday deadline.