Attackers exploiting CVE-2024-47575 on one FortiManager took running configs for more than 500 managed FortiGate firewalls, Unit 42 reports. Patching the manager does not retire the credentials and private keys in that archive.
Perspective Coverage
5 publishers
- Builder
- Builder 30%
- Operator
- Operator 60%
- Investor
- Investor 10%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence70
buildOne report1 publisher Gunra enters through the same VPN appliances the advisory says should front RDP
Gunra affiliates get in through two FortiOS and FortiProxy authentication bypasses, CVE-2024-55591 and CVE-2025-24472, says a 10 August 2026 advisory. Its fix for exposed RDP routes remote access through that same class of appliance, so the gateway has to be secured before RDP moves behind it.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+5
- Incentives30
- Confidence50
CISA says all four are under active exploitation, and three of them are unauthenticated flaws in edge and management appliances. Its own alert cites BOD 26-04 and prints no due date for any of them.
Perspective Coverage
4 publishers
- Builder
- Builder 14%
- Operator
- Operator 80%
- Investor
- Investor 6%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence70
buildOne report1 publisher FortiOS blocks central NAT while a single policy still references a VIP
Moving an ASA or PAN-OS rulebase onto a FortiGate means picking the NAT model on an empty appliance, because the toggle that gives back one shared NAT table is gated on every VIP and IP pool reference in the policy set.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap−5
- Incentives30
- Confidence58
CVE-2026-24858 let attackers log into Fortinet devices registered to other customers
Fortinet switched off FortiCloud SSO worldwide on January 26 and turned it back on the next day with server-side changes. Devices already fully patched against the two 2025 SAML bypasses were compromised anyway.
Reality
- Evidence70
- Adoption66
- Hype gap−8
- Incentives40
- Confidence65
One static binary now decrypts FortiOS firmware end to end, key included
fortitool folds a scatter of version-specific scripts into one dependency-free Go binary, and the drop in cost to inspect a Fortinet appliance lands the same for a defender and an attacker.
Publishers:blog.n0p.me
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+12
- Incentives45
- Confidence52
A six-agency #StopRansomware advisory dated August 10, 2026 gives defenders named CVEs, tooling and file extensions for a group that took about nine months to turn a variant into a business.
Reality
- Evidence78
- Adoption66
- Hype gap+12
- Incentives45
- Confidence74
Two years, 117 identified children: the only Com case this week with an outcome attached
A UK sentencing is the week's single security item measured in results rather than warnings, and the arithmetic is unflattering: 730 days of custody against 117 identified victims.
Reality
- Evidence52
- Adoption63
- Hype gap+18
- Incentives58
- Confidence46