"Fortinet's Ongoing Battle: Exploited RCE Flaws and Urgent Patching"
TL;DR
CISA confirms active exploitation of a critical remote code execution (RCE) bug (CVE-2024-21762) in Fortinet's FortiOS operating system, urging immediate patching or SSL VPN disabling to mitigate risks. Fortinet's confusing disclosure process regarding other RCE vulnerabilities (CVE-2024-23108 and CVE-2024-23109) in FortiSIEM was clarified, emphasizing the need to secure all Fortinet devices due to the high likelihood of exploitation by malicious actors for cyber espionage and ransomware attacks.
- New Fortinet RCE bug is actively exploited, CISA confirms BleepingComputer
- Fortinet Warns of New FortiOS Zero-Day SecurityWeek
- Fortinet's week to forget: Critical vulns, disclosure screw-ups, and that toothbrush DDoS attack claim The Register
- New Fortinet RCE flaw in SSL VPN likely exploited in attacks BleepingComputer
- Fortinet urges patching N-day bug amid ongoing nation-state exploitation CSO Online
Want the full story? Read the original reporting
Read on BleepingComputer