To bolster defenses, Fortinet has introduced enhanced security features in recent updates, including compile-time hardening, virtual patching, firmware integrity validation, and automated upgrade tools like Uninterrupted Cluster Upgrade and Automatic Patch Upgrades. Fortinet has uncovered a sophisticated post-exploitation technique used by a threat actor to maintain unauthorized access to FortiGate devices, even after initial vulnerabilities were patched. According to Fortinet’s findings, the threat actor exploited known vulnerabilities previously identified as FG-IR-22-398, FG-IR-23-097, and FG-IR-24-015—to gain access to FortiGate devices. The company emphasized the urgency of timely updates, citing its 2H 2023 Global Threat Landscape Report, which found that threat actors exploit known vulnerabilities within an average of 4.76 days of public disclosure. With over 40,000 vulnerabilities recorded in 2024, according to NIST data, Fortinet’s message is clear: staying vigilant and up to date is the best defense against today’s cyber threats. The discovery, detailed in a recent Fortinet investigation, highlights the persistent risks of unpatched systems and underscores the company’s commitment to responsible transparency and rapid response. Upon identifying the technique, Fortinet activated its Product Security Incident Response Team (PSIRT) and implemented immediate mitigations. Fortinet recommends that all customers impacted or not upgrade to the patched versions and follow recovery steps outlined in its community resources. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Customers seeking guidance can access Fortinet’s best practice resources or contact the company directly for support. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security. Alarmingly, the link could persist even after devices were updated to address the original vulnerabilities, leaving systems exposed. In a novel approach, the actor created a symbolic link between the user and root filesystems in a folder serving language files for SSL-VPN.
This Cyber News was published on cybersecuritynews.com. Publication date: Sat, 12 Apr 2025 05:55:14 +0000