FortiGate: the flaws attackers are actually using, and six checks for your office firewall

In a lot of Indian offices the firewall is a FortiGate. It was put in by a vendor a few years ago, it sits quietly in the rack next to the switch, and as long as the internet works nobody logs in to it. Usually the one person who knows the admin password is also the person who handles the printers, the CCTV and the Tally backup.

That quiet box is the front door of the company, and attackers know the address. FortiGate is one of the most targeted devices on the internet, not because it is badly made but because so many are out there, most of them reachable, and plenty of them a few versions behind.

The good news is that the list that matters is short. The US agency CISA keeps a catalogue of Known Exploited Vulnerabilities: flaws with evidence of use in real attacks, not just a theoretical score. In its edition of 23 October 2026, 21 entries affect FortiOS, the software every FortiGate runs. Read them together and a pattern jumps out: nearly all of them come in through two doors.

1 · Door one: the SSL-VPN

SSL-VPN is the feature that lets staff work from home with FortiClient. It has to face the internet, which makes it the favourite way in.

• CVE-2018-13379. Let anyone read files off the firewall without logging in, including the file holding VPN usernames and passwords. Fixed in May 2019. In September 2021 someone posted login details for 87,000 FortiGate VPNs collected through it, and Fortinet confirmed the leak. Devices patched later were still open if nobody changed the passwords.
• CVE-2022-42475, CVE-2023-27997 and CVE-2024-21762. Three separate bugs, one result: code running on the firewall, with no password needed. All three were used in real attacks soon after disclosure.
• The symlink backdoor. In April 2025 Fortinet disclosed that attackers who had come in through those three bugs left a hidden link behind, which kept read access to the firewall’s files even after it was patched. By mid-April Shadowserver had counted about 16,600 affected devices, and 7,886 of them were in Asia, the largest share of any region. Fortinet’s later releases remove the link, and CVE-2025-68686, added to the catalogue in July 2026, is a way around the earlier fix.

If SSL-VPN was never switched on, none of this applies to you. If it was, the patch alone is not the end of the story: passwords and the hidden link both survive an upgrade.

2 · Door two: the admin page, open to the internet

The second door is management access: the web admin page, SSH, or the port FortiManager uses, switched on for the interface that faces the internet. Vendors often enable it during installation so they can support you remotely, and then it simply stays.

• CVE-2022-40684 and CVE-2024-55591 let an attacker become super-admin through the admin interface, with no password.
• CVE-2025-24472, from the same Fortinet advisory, reached super-admin through a different kind of request, one meant for the Security Fabric.
• CVE-2024-23113 is in the service FortiGate uses to talk to FortiManager, and it gives code execution to anyone who can reach that port.
• CVE-2025-59718 and CVE-2026-24858 are both in FortiCloud single sign-on for the admin login, a feature many people did not know was on.

Every one of these needs the attacker to reach the admin interface. Take it off the internet and this whole family stops being your problem, even before you upgrade.

3 · The version question, and why 7.2 matters this month

Every fix above exists. Getting it depends on being on a branch of FortiOS that Fortinet still updates, and the timing here is sharp: FortiOS 7.2 left support on 30 September 2026, and 7.0 did so a year earlier. Plenty of FortiGates installed in 2022 and 2023 are still on one of them. They will get no fix for whatever is found next.

Moving branches is a planned job, not a click. Do the upgrade path Fortinet’s own upgrade tool gives you, step by step, with a configuration backup at each stage and a maintenance window on a Sunday morning rather than a Monday at eleven. Older hardware may not take 7.4 at all, and that is the moment to budget for a replacement rather than keep running a box nobody can patch.

4 · Six checks for this week

Each takes a few minutes with the admin login, and none needs a new purchase.

1. Write down the version. Dashboard › Status, or get system status. If it starts with 7.2, 7.0 or 6.x, plan the upgrade.
2. Close admin access from the internet. In Network › Interfaces, open the WAN interface and untick HTTPS, HTTP, SSH and FMG-Access. Manage it from inside the office, or over the VPN. If the vendor needs remote access, give it to their IP addresses only, through trusted hosts.
3. Is SSL-VPN on, and do you still need it? If yes, make every account use a second factor (FortiToken, or your Microsoft or Google sign-in). If nobody has used it since the lockdown days, switch it off.
4. Change the VPN passwords anyway. If the box was ever behind on updates while SSL-VPN was on, assume the old passwords are known. It is a twenty-minute job and an awkward email to staff, and it is worth both.
5. Look at the admin accounts. System › Administrators. Any account nobody recognises is a reason to call for help, not just to delete it.
6. Send the logs somewhere and set the clock. CERT-In’s directions ask for 180 days of logs kept in India and clocks synced to NIC or NPL (samay1.nic.in). A FortiGate on its own keeps a few days of logs at best, which leaves nothing to look at when you need it.

Our free firewall config check does most of this for you. Export the configuration backup, drop it in, and it reads the version against CISA’s catalogue, flags the symlink fix, admin access on the WAN, VPN accounts without a second factor, and the CERT-In clock and log settings. It strips passwords and keys first, and the file never leaves your browser.

And if what you find looks wrong, an account you did not create or a setting you did not change, treat it as an incident rather than a tidy-up. Under CERT-In’s rules the reporting clock is six hours, so it helps to decide early who makes that call.

Questions people ask