Skip to content
Cyber Security

FortiGate vulnerabilities: what to patch and what to check

The FortiGate and FortiOS flaws attackers have used since 2024, the versions that fix them, and the checks to run if your firewall was exposed.

Geidi Security Operations Team6 min read

In brief

What it is
Attackers have exploited a run of critical FortiGate and FortiOS flaws since 2024, several before most owners had patched.
Who it affects
Any organisation with a FortiGate firewall or VPN facing the internet.
What to do
Upgrade to the latest release on a supported branch, take management off the internet, remove features you don't use, and check for signs of entry.
On this page
  1. The ones that mattered
  2. "FortiBleed" was about passwords, not a new bug
  3. Are you affected?
  4. How to fix it
  5. If you think it already happened
  6. Where Geidi fits
  7. Sources

Your FortiGate sits on the edge of your network, answers anyone on the internet, and holds the keys to your VPN. That's exactly why attackers keep coming back to it. Since early 2024 Fortinet has published a steady run of critical FortiOS advisories, and several were exploited before most owners had read the email.

If you own a FortiGate, the questions are simple. Is the firmware current? Is the admin page reachable from the internet? And did anyone get in before you patched? This article covers the big ones and what to do about each.

The ones that mattered

CVE-2024-21762 (February 2024). An out-of-bounds write in the SSL VPN daemon that lets an unauthenticated attacker run code with a crafted HTTP request. Fortinet rated it 9.6 and published it on 8 February 2024. CISA added it to its Known Exploited Vulnerabilities (KEV) catalogue the next day. Fixed in FortiOS 7.4.3, 7.2.7, 7.0.14, 6.4.15, 6.2.16 and 6.0.18. Fortinet's only workaround was turning SSL VPN off; disabling web mode alone does not help.

CVE-2024-55591 (January 2025). An authentication bypass in the Node.js websocket module that hands an attacker super-admin rights through the management interface. It affects FortiOS 7.0.0 to 7.0.16 (fixed in 7.0.17) and some FortiProxy releases, and was exploited before the advisory went out on 14 January 2025. Fortinet later added CVE-2025-24472, a second route to the same result, to the same advisory.

The symlink persistence trick (April 2025). On 10 April 2025 Fortinet described attackers who had broken in through older SSL VPN flaws, including CVE-2024-21762, and then planted a symbolic link in the folder that serves SSL VPN language files. That link gave them read-only access to the device's files, configuration included, and it survived patching. Devices that never had SSL VPN enabled were not affected. FortiOS 7.6.2, 7.4.7, 7.2.11, 7.0.17 and 6.4.16 remove the link. In February 2026 Fortinet published CVE-2025-68686, a way around that fix on devices that were already compromised; 7.6.2 and 7.4.7 cover it, while 7.2, 7.0 and 6.4 have no fixed release and Fortinet's advice is to move to one that does. CISA added it to the KEV list in July 2026.

FortiCloud SSO (December 2025 and January 2026). CVE-2025-59718 and CVE-2025-59719 let an attacker bypass FortiCloud single sign-on with a forged SAML message. Then on 27 January 2026 Fortinet disclosed CVE-2026-24858: someone with their own FortiCloud account and registered device could log in to other people's devices, including ones already patched for the December bugs. The detail that caught people out: FortiCloud SSO is off in factory settings, but registering the device to FortiCare from the GUI turns it on unless you flick the toggle off. Fixed in FortiOS 7.6.6, 7.4.11, 7.2.13 and 7.0.19. It went on the KEV list the same day.

CVE-2025-25249 (published January 2026). A heap overflow in the cw_acd daemon, reachable on interfaces with "fabric" access allowed. Fortinet rated it high rather than critical, but CISA added it to the KEV list on 9 September 2026, which means someone is using it. Fixed in 7.6.4, 7.4.9, 7.2.12 and 7.0.18; 6.4 has no fix.

"FortiBleed" was about passwords, not a new bug

In June 2026 CISA warned of leaked credentials associated with roughly 74,000 Fortinet devices, firewalls and VPN gateways among them, in activity it referred to as "FortiBleed". Fortinet's own analysis on 19 June 2026 was blunt: this was not a new vulnerability. The attackers were reusing credentials taken in earlier incidents and brute-forcing devices with weak passwords and no MFA.

That matters because it changes what "fixed" means. A device that was compromised in 2025 and then patched may still have the attacker's password on it, or one they cracked from the configuration they copied.

Are you affected?

Log in and check the firmware version against the numbers above. If you are on 6.4 or older, you are running a branch that no longer gets fixes for several of these, and it's time to plan the upgrade rather than wait for the next one.

Then answer three questions:

  • Can the admin page (HTTPS or SSH) be reached from the internet?
  • Is SSL VPN enabled now, or was it ever?
  • Is "Allow administrative login using FortiCloud SSO" switched on under System, Settings?

A yes to the first one is the one to fix first. If your management interface is on the internet and you are not patching within days, assume someone else has already looked at it.

How to fix it

  1. Upgrade. Use Fortinet's upgrade path tool, go to the latest release on a supported branch (Fortinet points to 7.4, 7.6 or 8.0 as of June 2026), and do it in a maintenance window. Take a config backup first.
  2. Get management off the internet. Fortinet's own ranking: trusted hosts on admin accounts is good, a local-in policy is better, no internet administration at all is best. Manage it over the VPN or from inside the network.
  3. Remove what you don't use. If FortiCloud SSO isn't needed, turn it off (config system global, set admin-forticloud-sso-login disable). Remove "fabric" from allowaccess on internet-facing interfaces unless you really need it there.
  4. Fix the passwords. Reset every admin and local VPN password, terminate active admin and VPN sessions, and turn on MFA for all of them. Current 7.4, 7.6 and 8.0 releases support PBKDF2 hashing for admin passwords; the ACSC advises logging back in to each admin account after upgrading so the stored hash is converted.
  5. Keep IPS and AV signatures licensed and current. Fortinet used them to detect and clean the symlink on older branches.

If you think it already happened

Treat the configuration as compromised and follow Fortinet's recovery guide. In practice that means:

  • Look through the admin account list for anything you didn't create. Fortinet has seen random-looking names and ones dressed up as support, such as "forticloud", "fortiuser" or "fortinet-support".
  • Search the logs for admin logins with the interface shown as jsconsole, which was the tell for CVE-2024-55591.
  • Check for new VPN users, changed firewall policies and unexpected password resets.
  • If the FortiGate is joined to Active Directory or LDAP, treat that service account as compromised and check where else it has been used.
  • Rotate anything stored in the config: VPN pre-shared keys, LDAP and RADIUS secrets, certificates.

If the firewall let someone into the network, report it through ReportCyber at cyber.gov.au or call 1300 CYBER1 (1300 292 371). If personal information may have been accessed, you may also have obligations under the Notifiable Data Breaches scheme. Patching is one of the Essential Eight controls, and our plain-English guide to the Essential Eight maturity levels explains the timeframes it expects.

Where Geidi fits

FortiGate is one of the technologies Geidi works with. Our cyber security services are aligned to the Essential Eight, ISO/IEC 27001 and SMB1001, and backed by a 24/7 security operations centre. If you'd like to talk about your firewall, get in touch.

Sources

More on Cyber Security

One partner for the whole environment.

Tell us about your existing IT. We would be pleased to review your current system and give you an overview as to how Geidi may be able to deliver and enhance your IT operations.

Book a consultationCall 1300 855 049