FortiSIEM CVE-2026-106173: unauth RCE, PoC public, patch now
Fortinet patched a 9.4 path-traversal RCE in FortiSIEM 7.5.0 reachable unauthenticated over gRPC port 27918. Horizon3.ai has released a working PoC. Upgrade to 7.5.1.
Stories tagged: #fortinet
PeerStitch implant hid in FortiGate after FortiJump breach
Unit 42 details PeerStitch, a memory-resident FortiOS implant deployed in a telecom intrusion via CVE-2024-47575 and CVE-2025-61624. One FortiManager exposed 500+ managed firewalls.
Unit 42 details PEERSTITCH, a memory-only FortiGate implant
Unit 42 says CL-STA-0954 (Mandiant: UNC5820) chained FortiJump and CVE-2025-61624 to deploy PEERSTITCH, a disk-less ARM64 FortiOS implant, against a telecom MSP.
FortiMail zero-day CVE-2026-104286 exploited; CISA sets Oct 4
Fortinet says CVE-2026-104286, a CVSS 9.8 path-traversal flaw in FortiMail, is exploited in the wild; patch to 7.4.9/7.6.7/8.0.2 and hunt the published IOCs.
FortiSandbox: CVE-2026-25089 and CVE-2026-39808 land in KEV, exploited
CISA added two critical unauthenticated OS command injection flaws in Fortinet FortiSandbox to KEV on July 16, 2026. BOD 26-04 gave FCEB agencies until July 19 to patch. Both are CVSS 9.1.
FortiBleed dumps 73,932 Fortinet firewall creds; CISA orders resets
Researcher Bob Diachenko found an open attacker server holding plaintext admin and SSL VPN credentials for 73,932 FortiGate appliances across 194 countries. CISA issued reset guidance June 18.
Fortinet patches unauth command injection in FortiSandbox (CVE-2026-25089)
Crafted HTTP requests against the FortiSandbox web UI yield OS command execution. CVSS 9.1. No active exploitation reported. Fixed in 5.0.6 and 4.4.9.
FortiClient EMS bug CVE-2026-35616 now drops EKZ stealer as fake patch
Arctic Wolf says attackers are using the pre-auth FortiClient EMS flaw to push a previously undocumented infostealer disguised as a Fortinet endpoint update.