Fortinet Firewalls Under Continuous Attacks Despite Patches

In a concerning development, Fortinet customers are facing hacking attempts on their patched firewalls, despite the application of security patches. This revelation raises questions about the effectiveness of the patches and the ongoing security risks for organizations using Fortinet products.

Unpatched Vulnerabilities Persist

The root cause of these attacks appears to be an unresolved authentication bypass vulnerability (CVE-2025-59718) in FortiGate devices. Despite Fortinet releasing a patch for this vulnerability in early December 2025, affected FortiGate devices running FortiOS version 7.4.9 are still being compromised.

Fortinet is reportedly planning to release new versions of FortiOS (7.4.11, 7.6.6, and 8.0.0) to fully address this security flaw. However, the delay in a comprehensive fix has left Fortinet users vulnerable to attacks.

Attack Patterns and Impact

The attacks are reportedly initiated via maliciously crafted SAML messages, which allow attackers to compromise admin accounts. Affected users have reported the creation of new system admin users, posing a significant security risk.

It is essential to note that this issue could have severe implications for organizations in the North East region and across India, given the widespread use of Fortinet products.

Response and Mitigation Measures

Fortinet has yet to respond to queries regarding these reports. In the meantime, affected users are advised to temporarily disable the FortiCloud login feature to secure their systems.

Additional Vulnerabilities

It is concerning to note that hackers are also actively exploiting a critical Fortinet FortiSIEM vulnerability, which can enable code execution with root privileges on unpatched devices.

Implications and Future Considerations

The persistence of unpatched vulnerabilities in Fortinet products underscores the need for vigilant security practices. As organizations invest in cybersecurity solutions, it is crucial to prioritize regular updates and patches to minimize risks.

The ongoing attacks on Fortinet products serve as a reminder for all organizations to remain vigilant and proactive in their cybersecurity efforts. As we move forward, it is essential to learn from these incidents and continuously improve our security measures to protect against emerging threats.