Arctic Wolf detects surge in automated Fortinet FortiGate firewall configuration attacks
Overview
Arctic Wolf has reported a surge in automated attacks targeting Fortinet FortiGate devices, which has been ongoing since January 15, 2026. These attacks involve unauthorized changes to firewall configurations, with attackers creating generic accounts to maintain access, enabling VPN capabilities, and exfiltrating sensitive firewall data. This activity mirrors similar attacks identified in December 2025. Organizations using FortiGate firewalls should be vigilant, as these breaches can compromise network security and expose critical information. The situation emphasizes the need for enhanced security measures and monitoring to detect such unauthorized activities.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: Fortinet FortiGate devices
- Action Required: Organizations should implement strict access controls, regularly review firewall configurations, and monitor for unauthorized changes.
- Timeline: Ongoing since January 15, 2026
Original Article Summary
Arctic Wolf warned of a new wave of automated attacks making unauthorized firewall configuration changes on Fortinet FortiGate devices. Arctic Wolf researchers reported a new automated attack cluster observed since January 15, 2026, targeting FortiGate devices. Attackers created generic accounts for persistence, enabled VPN access, and exfiltrated firewall configurations. The activity resembles a December 2025 […]
Impact
Fortinet FortiGate devices
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Ongoing since January 15, 2026
Remediation
Organizations should implement strict access controls, regularly review firewall configurations, and monitor for unauthorized changes. Updating to the latest firmware and applying security patches as they are released is also recommended.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to Fortinet, Critical.