Active exploitation of vulnerabilities in Fortinet products

What is the Risk?

Researchers report that active exploitation of the vulnerabilities is being observed. Attackers can exploit the vulnerabilities and bypass Single Sign-On, allowing them to access the vulnerable systems (FortiOS, Fortiproxy, FortiWeb, and FortiSwitchManager).

Install the security updates

If your organization uses the aforementioned Fortinet software, the NCSC recommends installing available security updates as soon as possible. As a mitigating measure against Single Sign-On bypass, FortiCloud SSO login can be disabled.

Investigate whether abuse has occurred

Indicators of Compromise (IoCs) have been published to help you investigate whether abuse has occurred. The NCSC recommends closing open sessions for admin accounts after deploying the updates.

Get help if needed

If you are unsure whether your organization uses Fortinet FortiOS, FortiProxy, FortiWeb, or FortiSwitchManager, or have any doubts about the specific vulnerable versions or the shared Indicators of Compromise (IoCs), please check with an IT service provider as soon as possible.