VulnHub

The article discusses ongoing concerns around the FortiBleed vulnerability, which remains active and poses risks to numerous organizations. This vulnerability affects Fortinet's products, particularly those related to their FortiOS and FortiProxy systems. Attackers are exploiting this flaw, which could allow unauthorized access to sensitive information. The continued exploitation of FortiBleed highlights the need for companies using affected Fortinet products to prioritize patching and updates to safeguard their networks. Additionally, the article mentions an upcoming Patch Tuesday, which typically involves the release of security updates from Microsoft, emphasizing the importance of staying current with software patches.

The FBI and the Secret Service have issued a warning regarding the ongoing FortiBleed credential harvesting campaign, which targets Fortinet's FortiGate firewalls and SSL VPN gateways. This campaign has reportedly collected over 86,000 credentials, exploiting weaknesses in reused or leaked passwords and outdated password storage methods. Organizations using Fortinet products need to be vigilant, as attackers can gain unauthorized access to sensitive systems. The persistence of this threat highlights the importance of using strong, unique passwords and implementing robust security measures. Companies are urged to review their security protocols to protect against this active exploitation.

Fortinet has issued a warning to its customers regarding a zero-day vulnerability (CVE-2026-104286) in its FortiMail email security gateway. This flaw, which involves improper path traversal and handling of null bytes, allows unauthenticated attackers to exploit the system. Reports indicate that this vulnerability is currently being actively exploited in the wild, raising concerns about potential unauthorized access to sensitive email communications. Fortinet has advised users to implement a temporary workaround until a permanent fix is available. This vulnerability poses significant risks to organizations relying on FortiMail for email security, making it crucial for users to take immediate action to safeguard their systems.

Fortinet has issued a warning about a serious vulnerability in its FortiMail product, identified as CVE-2026-104286. This flaw is currently being exploited by attackers in zero-day attacks, allowing them to execute unauthorized code or commands on affected devices. Organizations using FortiMail should be particularly vigilant, as this vulnerability poses a significant risk to their email security systems. Fortinet has advised its customers to take immediate action to protect their systems from potential breaches. Users are encouraged to stay updated with patches and security measures to mitigate the risks associated with this vulnerability.

A Thai broadband provider has fallen victim to a cyber attack that exploited a vulnerability in Fortinet's security products. The attackers used various scripts for reconnaissance and probing, along with brute-force tools and methods to escalate privileges within the network. This breach raises concerns about the security of internet service providers and their ability to protect customer data. As the incident unfolds, it serves as a reminder for organizations to patch known vulnerabilities promptly and strengthen their defenses against such tactics. Users of the affected service may need to monitor their accounts for any unusual activity as a precaution.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified three serious vulnerabilities affecting products from Cisco, Citrix, and Fortinet. These vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog, which means federal agencies are required to patch them by September 12, 2026. One of the vulnerabilities, CVE-2026-20079, has a maximum severity score of 10.0, indicating a critical risk. It's crucial for organizations using these products to prioritize these updates to protect against potential exploitation. Failure to address these vulnerabilities could lead to significant security breaches, putting sensitive data at risk.

The Cybersecurity and Infrastructure Security Agency (CISA) has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that these flaws are currently being exploited in the wild. The vulnerabilities include a heap-based buffer overflow in Fortinet products (CVE-2025-25249), an authentication bypass in Citrix NetScaler (CVE-2026-19490), an out-of-bounds write in Google Chromium's V8 engine (CVE-2026-87491), and another authentication bypass affecting Cisco Firewall Management Center (CVE-2026-20079). These vulnerabilities pose significant risks, especially to federal agencies, which are urged to prioritize quick remediation efforts based on a directive from CISA. While the directive primarily affects federal entities, CISA encourages all organizations to adopt similar risk-based practices to address these vulnerabilities effectively. Organizations are also invited to report any exploited vulnerabilities not yet listed in the KEV Catalog for evaluation.

Siemens has alerted users to vulnerabilities affecting its RUGGEDCOM APE1808 device due to issues in Fortinet's FortiOS software. Two specific vulnerabilities, identified as CVE-2026-23573 and CVE-2026-59839, can allow attackers to execute unauthorized commands or access restricted files if they have the necessary privileges. These vulnerabilities could potentially impact critical sectors such as manufacturing, energy, and transportation. Siemens advises affected users to contact their customer support for more details on mitigation measures and to follow Fortinet's advisory for workarounds. This situation underscores the need for robust network security measures to safeguard critical infrastructure.

Hackers recently targeted a combined heat and power (CHP) plant in Poland, exploiting vulnerabilities in a Fortinet device and a private Access Point Name (APN). This breach allowed attackers to access key components like Programmable Logic Controllers (PLCs), leading to disruptions in turbine operations and water treatment systems. The Polish Computer Emergency Response Team (CERT) labeled this incident as a significant threat to the energy sector, particularly because it illustrates how seemingly standard network configurations can provide a pathway for cyberattacks. The implications of this breach are serious, as disruptions in energy infrastructure can have widespread effects on public services and safety.

Cybersecurity researchers have identified a supply chain attack targeting QuickFox, a VPN tool favored by overseas Chinese users. The attack has reportedly been active since at least August 2025, involving a compromised version of the application that delivers the FDMTP backdoor. This backdoor allows attackers to gain unauthorized access to affected systems, posing significant risks to user privacy and data security. This incident raises concerns about the security of software supply chains, particularly for tools that are essential for users in sensitive environments. Users of QuickFox should be vigilant and consider alternative solutions while the situation is investigated further.

On July 27, 2026, federal cybersecurity officials issued an emergency alert regarding serious vulnerabilities found in Fortinet and Arista routers. These flaws are reportedly being exploited by attackers, raising concerns about the security of networks that rely on these devices. Organizations using affected Fortinet and Arista products are urged to implement the necessary patches to protect against potential breaches. This situation underscores the need for timely updates and vigilant monitoring of network devices, as attackers are actively seeking to exploit these weaknesses. Federal authorities are closely monitoring the situation and advising companies to prioritize these updates to safeguard their systems.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added vulnerabilities associated with Arista VeloCloud Orchestrator and Fortinet's FortiOS to its Known Exploited Vulnerabilities catalog. The specific vulnerability for Arista is identified as CVE-2025-68686. This inclusion indicates that these flaws are being actively exploited, posing a significant risk to users of these products. Organizations using Arista's VeloCloud Orchestrator or Fortinet's FortiOS should take immediate action to address these vulnerabilities to safeguard their systems from potential attacks. The urgency of this update emphasizes the need for timely patching and monitoring of network security.

The Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating that they are actively being exploited by attackers. The first vulnerability, CVE-2025-68686, affects Fortinet's FortiOS, allowing unauthorized access to sensitive information. The second, CVE-2026-16812, impacts Arista's VeloCloud Orchestrator, enabling command injection attacks on the on-premises operating system. These vulnerabilities pose serious risks, particularly to federal agencies, which are urged to prioritize their remediation under Binding Operational Directive 26-04. While the directive specifically targets federal civilian agencies, CISA recommends that all organizations adopt similar risk-based approaches to vulnerability management to protect against these threats.