Related Threat Clusters
-
Exploitation of FortiGate SSO Vulnerabilities by Threat Actors
Threat actors are actively exploiting critical authentication bypass vulnerabilities in Fortinet's FortiGate appliances, specifically CVE-2025-59718 and CVE-2025-59719. These vulnerabilities allow unauthenticated single…
4 articles · Updated December 16, 2025 -
Operation Escaneo Targets Latin American Critical Infrastructure
Operation Escaneo is a coordinated cyberattack attributed to the MexicanMafia group, targeting critical infrastructure across Latin America, primarily Mexico. The campaign, which spanned from 2025 to 2026, utilized…
4 articles · Updated June 18, 2026 -
Critical Vulnerabilities in FortiOS and Arista VeloCloud Under Active Exploitation
Fortinet's FortiOS and Arista's VeloCloud Orchestrator On-Prem are currently under attack due to critical vulnerabilities. The FortiOS vulnerability (CVE-2025-68686) allows unauthorized access to confidential…
2 articles · Updated July 28, 2026 -
New Vulnerabilities Discovered in Serial-to-IP Converters Threaten Critical Infrastructure
Forescout Technologies has identified 22 new vulnerabilities in serial-to-IP converters from Lantronix and Silex, which are widely used in critical sectors like healthcare and utilities. These vulnerabilities,…
9 articles · Updated April 21, 2026 -
Cyberattack on Polish Energy Sector Exploits Private APN Vulnerability
In December 2025, hackers breached a Polish combined heat and power (CHP) plant using a private Access Point Name (APN) to access the operational technology network. The attack, attributed to the Russian Electrum threat…
8 articles · Updated August 10, 2026 -
FortiBleed Campaign Compromises 75,000+ Fortinet Devices Globally
A credential-harvesting campaign known as 'FortiBleed' has compromised over 75,000 Fortinet firewalls and VPNs across 194 countries. The attackers, suspected to be Russian-speaking cybercriminals, exploited previously…
105 articles · Updated June 17, 2026 -
Nightmare-Eclipse Tools Exploit FortiGate VPNs in Live Attacks
A recent intrusion campaign utilized the Nightmare-Eclipse privilege escalation tools, specifically BlueHammer, RedSun, and UnDefend, following unauthorized access through compromised FortiGate SSL VPN credentials. This…
2 articles · Updated April 22, 2026 -
Critical RCE Vulnerabilities Discovered in Fortinet Products
Fortinet has identified multiple critical vulnerabilities in its FortiSandbox and FortiAuthenticator products, which could allow unauthenticated attackers to execute arbitrary code remotely. The vulnerabilities are…
107 articles · Updated May 12, 2026 -
Critical Vulnerabilities in Fortinet Products Allow Unauthorized Access
Fortinet has disclosed multiple vulnerabilities affecting its products, including FortiWeb, FortiManager, and FortiClientWindows. The most critical, CVE-2026-26035, allows remote unauthenticated access to FortiWeb…
2 articles · Updated August 14, 2026 -
Fortinet Issues Security Advisory for Critical Vulnerabilities
On March 10, 2026, Fortinet released a security advisory addressing eleven vulnerabilities in its core products, including a high-severity stack-based buffer overflow in FortiManager (CVE-2025-54820) that allows remote…
88 articles · Updated March 10, 2026
Recent Intelligence Reports
- CVE-2026-70468 — www.fortiguard.com · August 14, 2026
- Cve 2024 55591 Fortinet Authentication Bypass Zero Day Vulnerability Exploited In The Wild — www.tenable.com · August 12, 2026
- SuperBlack exploited — www.cybersecuritydive.com · August 12, 2026
- Hackers breached a small Polish energy plant via private APN last year — Bleepingcomputer · August 10, 2026
- Unmasking The Gentlemen Ransomware — www.trendmicro.com · August 8, 2026
- CVE-2025-68686 — fortiguard.fortinet.com · July 29, 2026
- FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs — Darkreading · July 2, 2026
- Ctrl+Alt+Oops: FortiBleed criminal's logins stitch two gangs together — Theregister · July 2, 2026