#Fortinet
All CosmicBytez Labs articles tagged #Fortinet, across news, security advisories, how-to guides, and projects.
- News
Alert: FortiBleed Remains an Active Campaign, Can Lock Out Users or Lead to Ransomware
The FBI and Secret Service warn FortiBleed is still active, now tied to 400,000+ Fortinet devices and causing lockouts that precede ransomware attacks.
- News
Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware Arrests
This week: a critical unauthenticated FortiMail 0-day, 13,000+ leaked AI-agent screenshots, a new Spectre v2 variant, and ransomware takedowns.
- News
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
CISA added FortiMail flaw CVE-2026-104286 (CVSS 9.8) to its KEV catalog after active exploitation; no patch yet, only workarounds.
- News
Exploited Fortinet FortiMail Zero-Day Calls for Urgent Action
CVE-2026-104286, a critical FortiMail path traversal flaw (CVSS 9.8), is under active exploitation. No patch yet — Fortinet urges workarounds now.
- News
Critical FortiMail Zero-Day CVE-2026-104286 Actively Exploited, No Patch Yet
CISA added CVSS 9.8 FortiMail flaw CVE-2026-104286 to its KEV catalog after active exploitation; Fortinet has no fix, only workarounds.
- News
Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
Unauthenticated attackers can run OS commands on Orkes Conductor via unsandboxed script evaluators. Fortinet blocked ~7,000 attempts in a week.
- News
Thai Broadband Provider Hacked via Fortinet Vulnerability
Hunt.io found 298 staged attack tools tied to a CVE-2024-21762 FortiGate SSL-VPN exploit used to breach Thai ISP 3BB and target RADIUS credentials.
- Newsletter
Weekly Digest — Issue #35
Cisco's email gateway gets root-RCE'd via crafted SQL, GitLab ships a perfect 10.0 path traversal, and China chains three zero-days to backdoor NGOs.
- News
Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks
A CISA/FBI joint advisory warns that Gunra ransomware — a Conti-derived RaaS — has claimed 51+ victims by exploiting critical Fortinet FortiOS...
- News
CISA Orders Immediate Patching of Actively Exploited Fortinet FortiSandbox Flaws
CISA added two critical Fortinet FortiSandbox OS command injection vulnerabilities to its KEV catalog and gave federal agencies just three days to patch,...
- News
FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs
Threat actors who exploited the FortiBleed vulnerability to gain persistent access to thousands of Fortinet firewalls are now monetizing that access by...
- News
FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations
SOCRadar uncovered FortiBleed — a large-scale credential-harvesting campaign targeting 11,250 FortiGate portals across 150+ countries, resulting in 110...
- News
FortiBleed Credential-Theft Campaign Linked to Lynx Ransomware Group
Researchers have connected the massive FortiBleed credential-theft operation — which harvested credentials from over 86,000 FortiGate firewalls — directly...
- News
FortiBleed: 5-Stage Attack Chain Behind 110 Million Credential Heist on FortiGate Firewalls
Deep analysis of the FortiBleed operation reveals a sophisticated five-stage credential harvesting pipeline — custom Golang sniffers, Telegram-based...
- News
FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist
The FortiBleed campaign's operators weaponize Fortinet's own built-in diagnostic command to run a custom Golang sniffer that intercepts 24 authentication...
- News
FortiBleed: Russian IAB Harvested 110 Million Credentials from 430,000 FortiGate Firewalls
A financially motivated Russian-speaking initial access broker behind the FortiBleed campaign has been systematically harvesting credentials from over...
- News
Russian Initial Access Broker Behind FortiBleed Campaign
A Russian-speaking initial access broker has compromised 86,644 verified credentials from over 430,000 internet-facing Fortinet FortiGate devices across...
- Newsletter
June 23 Digest: FortiBleed, Klue/Salesforce Supply Chain, Squidbleed, GitHub Actions Fix
A Russian IAB harvests 110M credentials from FortiGate firewalls; the Icarus group drains hundreds of Salesforce orgs via Klue OAuth tokens; a 29-year-old...
- News
FortiBleed Campaign Used Custom FortiGate Sniffer to Steal Credentials
The large-scale FortiBleed campaign targeting Fortinet FortiGate devices deployed custom packet sniffers to harvest authentication secrets from...
- News
CISA Warns Fortinet Users to Secure Devices After FortiBleed Credential Leak
Nearly 74,000 Fortinet firewall and VPN credentials were exposed in the FortiBleed data leak, prompting CISA to urge immediate device hardening and...
- News
Attackers Hit Pair of Critical Fortinet Vulnerabilities the Vendor Disclosed in April
Multiple threat intelligence firms have confirmed active exploitation of two critical vulnerabilities in Fortinet's FortiSandbox product — security flaws...
- News
FortiBleed Leak Exposes Fortinet VPN Credentials for 73,000 Devices
A data leak dubbed FortiBleed has exposed configuration files and VPN credentials for 73,932 Fortinet firewall URLs, putting organizations worldwide at...
- News
Critical FortiClient EMS Vulnerability Exploited in Fresh Attacks
Fortinet's April hotfix for the actively exploited CVE-2026-35616 FortiClient EMS flaw is now seeing renewed exploitation, as attackers continue targeting...
- News
Ivanti, Fortinet, SAP, VMware, n8n Patch RCE, SQL
A coordinated wave of critical security patches landed this week from Ivanti, Fortinet, SAP, VMware, and n8n. Topping the list is CVE-2026-8043 in Ivanti...
- News
Fortinet Warns of Critical RCE Flaws in FortiSandbox and FortiAuthenticator
Fortinet has released emergency security patches for two critical vulnerabilities in FortiSandbox and FortiAuthenticator that could enable attackers to...
- Newsletter
May 12 Digest: AI-Generated Zero-Day, Shai-Hulud Worm
Google confirms the first AI-generated zero-day in the wild; TeamPCP's Mini Shai-Hulud worm hits TanStack, Mistral AI, and Guardrails AI; Instructure pays...
- News
Mirai Variant Nexcorium Exploits CVE-2024-3721 to Hijack
Threat actors are deploying the Nexcorium Mirai botnet variant by exploiting CVE-2024-3721 in TBK DVR devices and targeting end-of-life TP-Link Wi-Fi...
- Newsletter
Apr 7 Digest: Medusa Ransomware Surge, FBI $21B Record
Storm-1175 runs sub-24-hour Medusa ransomware campaigns using zero-days; the FBI IC3 reports a record $21 billion in US cybercrime losses for 2025; North...
- News
Fortinet FortiClient EMS Zero-Day CVE-2026-35616 Actively
A critical zero-day in FortiClient EMS with a CVSS score of 9.8 is being actively exploited in the wild while Fortinet has released only an emergency...
- News
Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits
This week's biggest cybersecurity stories: a North Korean supply chain attack hit the Axios npm package, a new Chrome zero-day under active exploitation,...
- News
Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS
Fortinet has released emergency out-of-band patches for CVE-2026-35616, a critical pre-authentication API access bypass in FortiClient EMS that enables...
- News
New FortiClient EMS Flaw Exploited in Attacks, Emergency
Fortinet has released an emergency weekend security update for CVE-2026-35616, a critical pre-authentication API access bypass in FortiClient EMS that is...
- News
Critical Fortinet FortiClient EMS Flaw Now Exploited in Attacks
Threat intelligence firm Defused confirms active in-the-wild exploitation of a critical vulnerability in Fortinet's FortiClient EMS platform....
- News
AI-Armed Amateur Hacker Compromises 600+ FortiGate
Amazon's threat intelligence team has documented how a Russian-speaking, financially motivated actor used multiple commercial generative AI tools to...
- HOWTO
FortiGate Performance Optimization: A Tuning Guide for Throughput
Optimize FortiGate performance with NP/CP offloading, session table tuning, UTM profile optimization, SD-WAN performance rules, conserve mode prevention,...
- HOWTO
FortiGate Security Hardening: Best Practices for Enterprise
Complete FortiGate hardening guide covering admin access lockdown, firmware management, interface hardening, DNS/NTP security, certificate management,...
- Security
Fortinet FortiOS SSL VPN Heap Overflow Enables Pre-Auth RCE
Fortinet patches a critical heap-based buffer overflow in FortiOS SSL VPN that allows unauthenticated remote code execution on FortiGate appliances....
- Security
Critical Fortinet FortiClientEMS SQL Injection
Fortinet patches a CVSS 9.8 SQL injection in FortiClientEMS 7.4.4 allowing unauthenticated remote code execution. Endpoint management servers across...
- HOWTO
FortiAnalyzer Log Forwarding and Compliance Reports
Configure FortiAnalyzer for centralized logging, SIEM integration, and compliance reporting. Covers syslog forwarding, custom log handlers, and PCI/HIPAA...
- HOWTO
FortiGate Firewall Policy Management with PowerShell
Automate FortiGate firewall policy creation, backup, and auditing using PowerShell and the FortiOS REST API. Includes bulk rule deployment, change...
- HOWTO
FortiGate IPsec VPN: Site-to-Site with Azure
Configure IPsec site-to-site VPN between FortiGate firewall and Azure VPN Gateway. Covers IKE configuration, routing, BGP, and high availability.
- HOWTO
FortiGate SSL VPN Setup: Secure Remote Access Configuration
Configure FortiGate SSL VPN for secure remote user access. Covers portal setup, user authentication, firewall policies, and FortiClient configuration.
- Project
FortiGate SD-WAN Deployment
Deploy enterprise SD-WAN with FortiGate featuring dual ISP failover, performance SLAs, application steering, and Zero Trust architecture integration.
- Project
Fortinet Centralized Management with FortiManager &
Deploy enterprise-grade centralized management for your Fortinet Security Fabric with FortiManager for configuration management and FortiAnalyzer for...
- Newsletter
Security Roundup & FortiGate Deep Dive - Issue #2
This week: FortiGate SD-WAN deployment, new CVEs affecting critical infrastructure, and Azure Sentinel implementation tips.
- News
Mass Exploitation of Fortinet FortiGate Devices Underway
Security researchers warn of mass exploitation campaigns targeting Fortinet FortiGate firewalls. Over 50,000 devices believed to be compromised globally.