Attackers Are Abusing FortiGate Firewalls as Entry Points: What You Need to Know

TamilTech AI summary

Attackers are mass-exploiting critical FortiGate FortiOS flaws—especially unauthenticated SSL-VPN bugs like CVE-2024-21762, CVE-2023-27997, and CVE-2024-23113—so a crafted request can give them root-level code execution on the firewall itself and turn your perimeter guard into the front door. That matters because groups from Volt Typhoon to ransomware crews and initial-access brokers are using it against banks, hospitals, government, manufacturing, and critical infrastructure worldwide, including Indian orgs that CERT-In has already warned about. Once inside, they harvest VPN credentials, move laterally as “legit” users, and sometimes plant firmware backdoors that even survive patches and factory resets, so simply updating is not enough if you never hunted for compromise. Hundreds of thousands of FortiGate SSL-VPN portals have been exposed online, and old leaked credentials often still work when passwords were never rotated. If you run FortiGate, patch to the fixed FortiOS builds now, assume breach and check logs, odd admin accounts, and strange files, rotate all VPN credentials, lock management to trusted IPs, prefer IPsec over SSL-VPN when you can, and turn on MFA—because a firewall is software that needs the same urgent care as any other internet-facing system.

• Which FortiGate vulnerability is being actively exploited?
• Who is behind these FortiGate attacks?
• How do I know if my FortiGate device is compromised?
• What should I do immediately if I use FortiGate?

AI-assisted summary, checked by the TamilTech editorial team.