New Wave of Attacks Targeting FortiGate Firewalls

SecurityWeek

January 22, 2026 at 12:10 PM

Actively Exploited

Overview

Recent attacks have targeted FortiGate firewalls, specifically exploiting vulnerabilities in the FortiCloud SSO login system. Hackers are bypassing authentication measures to create unauthorized accounts, which allows them to alter device configurations. This poses a significant risk to organizations using FortiGate products, as attackers can manipulate firewall settings and potentially compromise network security. Security researchers have raised alarms about this issue, urging companies to take immediate action to secure their devices. The situation underscores the need for vigilance in monitoring access to critical security infrastructure.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: FortiGate firewalls, FortiCloud SSO
Action Required: Organizations should immediately review their FortiGate configurations and implement stricter access controls.
Timeline: Newly disclosed

Original Article Summary

Hackers bypass the FortiCloud SSO login authentication to create new accounts and change device configurations. The post New Wave of Attacks Targeting FortiGate Firewalls appeared first on SecurityWeek.

Impact

FortiGate firewalls, FortiCloud SSO

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should immediately review their FortiGate configurations and implement stricter access controls. Regular audits of user accounts and monitoring for unusual activity are also recommended.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Critical.

Read Original Article

Related Coverage

Dragos: Despite AI use, new malware targeting water plants is ‘hype’

CyberScoop

A new piece of malware named ZionSiphon has emerged, reportedly aimed at disrupting water supplies in Israel. However, experts from Dragos, a cybersecurity firm specializing in operational technology, have assessed the malware as ineffective and likely the work of inexperienced individuals utilizing artificial intelligence. This raises questions about the actual capabilities of the malware and the seriousness of the threat it poses. Despite the sensational headlines, experts suggest that the hype surrounding ZionSiphon may outweigh its real-world impact. Understanding the limitations of such attacks is crucial for water facility operators, who must remain vigilant but not overly alarmed by exaggerated claims.

Apr 23, 2026

A dozen allied agencies say China is building covert hacker networks out of everyday routers

CyberScoop

A coalition of twelve allied agencies has issued a warning regarding a shift in tactics by Chinese hackers, who are reportedly using common routers to build covert hacking networks. These everyday devices, often overlooked in terms of security, can be exploited to gain unauthorized access to sensitive information. Organizations are advised to enhance their security measures by regularly updating router firmware, changing default passwords, and monitoring network traffic for unusual activity. This development is particularly concerning given the widespread use of consumer-grade routers, which could be leveraged to compromise a vast number of networks. The implications are significant, as this tactic could enable attackers to infiltrate both personal and corporate systems without detection.

Apr 23, 2026

Over $12M stolen in North Korean crypto heist against web developers

SCM feed for Latest

A North Korean hacking group known as HexagonalRodent has reportedly stolen up to $12 million in cryptocurrency from Web3 developers. This operation, linked to the state-backed group Famous Chollima, took place between January and March of this year. The attackers targeted individuals and organizations involved in Web3 technology, which includes decentralized applications and blockchain development. The stolen funds could be used to finance North Korea's activities, raising concerns about the implications for both the cryptocurrency industry and international security. As the threat from state-sponsored cybercrime continues to grow, developers in the tech space need to enhance their security measures to protect against such sophisticated attacks.

Apr 23, 2026

Actively exploited SharePoint spoofing bug continues to threaten over 1,300 instances

SCM feed for Latest

A critical vulnerability in Microsoft SharePoint, identified as CVE-2026-32201, is currently being exploited by attackers. Over 1,300 SharePoint servers exposed to the internet remain at risk, with fewer than 200 instances patched since the last Patch Tuesday. This zero-day spoofing flaw allows unauthorized access, which could lead to significant data breaches or further intrusions. Organizations using SharePoint should prioritize applying available updates to mitigate the risk and secure their systems against ongoing attacks. The situation underscores the urgency for users to remain vigilant and proactive in patch management.

Apr 23, 2026

Cosmetics giant Rituals discloses data breach affecting customers

BleepingComputer

Rituals, a Dutch cosmetics company, has reported a data breach that has compromised the personal information of customers in its 'My Rituals' membership database. While the exact number of affected individuals remains undisclosed, the breach raises concerns about the security of customer data in an era where personal information is increasingly targeted by cybercriminals. This incident serves as a reminder for companies to prioritize data protection measures and for customers to be vigilant about their personal information. Rituals has yet to provide detailed guidance on how affected customers can protect themselves or what steps the company is taking to address the breach. Such breaches can lead to identity theft and other security risks, making it crucial for both companies and consumers to take proactive measures against data vulnerabilities.

Apr 23, 2026

Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign

The Hacker News

The Bitwarden CLI tool has been compromised as part of an ongoing supply chain attack linked to Checkmarx, as reported by security researchers from JFrog and Socket. The malicious code was found in the package version @bitwarden/cli@2026.4.0, specifically within a file named 'bw1.js.' This incident raises concerns for users of the Bitwarden CLI, as the compromised package could potentially allow attackers to execute harmful actions via the tool. Organizations and individuals using this version should take immediate action to protect their data. The incident underscores the risks associated with supply chain vulnerabilities, which can affect a wide range of software users and developers.

Apr 23, 2026