#fortigate

[ follow ]
#generative-ai #cve-2025-59718 #credential-stuffing #lateral-movement #ai-assisted-attacks
#generative-ai
more#generative-ai
fromSecurityWeek
2 weeks ago

Hundreds of FortiGate Firewalls Hacked in AI-Powered Attacks: AWS

Over 600 Fortinet FortiGate firewall instances have been hacked in an AI-powered campaign that exploits exposed ports and weak credentials, AWS reports. The attacks, observed between January 11 and February 18, did not target known vulnerabilities. Instead, they focused on the exploitation of exposed device configurations across globally dispersed appliances. According to AWS, the campaign was carried out by an unsophisticated threat actor that relied on multiple commercial gen-AI services to implement known attack techniques.
Information security
Information security
fromTheregister
1 month ago

FortiGate firewalls hit by silent SSO attacks & config theft

Attackers are bypassing SSO to reconfigure FortiGate firewalls, create backdoor admins, export configurations, and exfiltrate sensitive credentials using authentication bypass vulnerabilities.
fromThe Hacker News
2 months ago

Fortinet FortiGate Under Active Attack Through SAML SSO Authentication Bypass

Cybersecurity company Arctic Wolf said it observed active intrusions involving malicious single sign-on (SSO) logins on FortiGate appliances on December 12, 2025. The attacks exploit two critical authentication bypasses (CVE-2025-59718 and CVE-2025-59719, CVSS scores: 9.8). Patches for the flaws were released by Fortinet last week for FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. "These vulnerabilities allow unauthenticated bypass of SSO login authentication via crafted SAML messages, if the FortiCloud SSO feature is enabled on affected devices," Arctic Wolf Labs said in a new bulletin.
Information security
Information security
fromThe Hacker News
10 months ago

Fortinet Warns Attackers Retain FortiGate Access Post-Patching via SSL-VPN Symlink Exploit

Fortinet warns that attackers maintain read-only access to vulnerable FortiGate devices by exploiting symlinks, despite patching initial vulnerabilities.
[ Load more ]