DanSec

Vendor

Fortinet

In 83 briefs, most recently 25 October 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Known exploited (CISA KEV)

32 Fortinet vulnerabilities are on CISA's list of vulnerabilities exploited in the wild, 14 of them used in ransomware campaigns. Most recent:

Coverage in DanSec Daily

  1. Quest Diagnostics and Capcom breaches, LiteLLM master key leak, and unpatched PHP2Shell RCE drawing Mirai botnet exploitation attempts.
  2. Quest Diagnostics patient data breach, Capcom's 11.7M-record exposure, and PHP2Shell RCE with no patch, plus Brotli and ArubaOS flaws.
  3. Lazarus Group's FlashHole watering-hole campaign, Tor exit relay hijacking, and Zeabur's second breach in two months.
  4. ConnectWise cloud outage, ETS breach exposing millions of California student records, and OpenCode legacy breach exposing stored AI API keys.
  5. BeyondTrust zero-day exploited by Armory Castle, PwnEscape Linux VM escape flaw, and BAE Systems attack disrupting US bankruptcy court notices.
  6. Ivanti Connect Secure zero-days chained for root RCE, Microsoft's 1,400-flaw Patch Tuesday with an exploited Windows Shell bug, and a Meta GitHub breach.
  7. The ASOS breach, Google domain hijacking via .gh/.sl/.as registries, FortiBleed attacks on Fortinet FortiGate, and Atlassian CVE-2026-21589 exploitation.
  8. ASOS data breach, actively exploited Atlassian Data Center flaw, and FortiBleed Fortinet credential harvesting.
  9. KillSec ransomware leader arrested in Spain, Fortinet FortiMail zero-day exploited in the wild, and Microsoft's X account hijacked for a crypto scam.
  10. Gyazo breach exposing 23.6M records, actively exploited Orkes Conductor flaw, and a CVSS 10.0 Cisco ISE zero-day authentication bypass.
  11. AdaptHealth breach hits 4.1M people, Trezor users targeted by phishing, Veradigm patient data leak; plus Fortinet and Cisco exploits.
  12. Trezor customer data breach via ShipMonk, actively exploited VMware vCenter Syslog RCE, and Apple mercenary spyware alerts.
  13. Microsoft August Patch Tuesday zero-days, Cisco ASA/FTD exploitation, Mozilla signing key exposure, and Gunra ransomware warnings.
  14. Coca-Cola's Fairlife ransomware halts US dairy output; 23andMe pays $18M to 43 states; Scattered Spider pair jailed over TfL hack.
  15. Dutch and Spanish police bust major fraud rings; Firefox, Zoom, SharePoint and LegacyHive Windows zero-day flaws. Plus OkoBot and AsyncAPI npm supply chain …
  16. Google and FBI disrupt NetNut proxy network, Scattered Spider suspect extradited, and Pegasus spyware hits EU Parliament investigators; plus Cursor and WinRAR …
  17. The Medtronic data breach by ShinyHunters, exposed Oracle E-Business Suite instances under attack, and Scattered Spider arrest news.
  18. Tata Electronics cyberattack and Klue OAuth-token breaches hitting LastPass and Salesforce customers, plus FortiBleed hitting 430,000 FortiGate firewalls with …
  19. Xsolis breach exposes 1.4M patients' health data, FortiBleed harvests 86,000 Fortinet credentials, and Squidbleed leaks proxy traffic.
  20. Klue integration breach exposes Salesforce data, FortiBleed credential theft hits ~86,000 Fortinet devices, and Operation Endgame disrupts SocGholish.
  21. Klue OAuth breach exposed Salesforce data, FortiBleed leaked ~74,000 Fortinet credentials, and law enforcement disrupted the SocGholish botnet.
  22. Fortinet FortiBleed leak exposes 73,932 VPN credentials, Kodak confirms a ShinyHunters breach, and Microsoft Defender zero-day RoguePlanet emerges.
  23. Kodak breach by ShinyHunters, iRhythm ransom theft, and three Fortinet FortiSandbox flaws actively exploited across up to 30,000 devices.
  24. Microsoft GitHub repos hijacked in Miasma worm supply chain attack, ServiceNow API breach, Russia-aligned WinRAR espionage, record 206 Patch Tuesday fixes.
  25. Charter and Carnival breaches by ShinyHunters, FortiClient EMS CVE-2026-35616 exploitation, and Gogs and Gitea flaws.
  26. Grafana source code theft, the ShinyHunters-linked 7-Eleven breach, and an unpatched zero-day in Microsoft Exchange under active exploitation.
  27. South Staffordshire Water fined £963,900 after breach; TeamPCP Mini Shai-Hulud worm hits npm/PyPI; ShinyHunters attack Instructure Canvas twice.
  28. Ukrainian targeting by UAC-0247's AgingFly malware, a compromised WordPress EssentialPlugin package, and an nginx-ui flaw exploited in the wild …
  29. Basic-Fit and Booking.com breaches, Adobe zero-day CVE-2026-34621, CPUID trojanized installers, and APT41 cloud credential theft.
  30. Wynn Resorts breach affecting 21,000 employees, Drift Protocol's $280M in-person crypto heist, and Flowise and FortiClient EMS exploits.
  31. The $285M Drift hack by North Korean actors, Fortinet FortiClient EMS exploitation (CVE-2026-35616), and the BKA unmasking of REvil ransomware operators.
  32. European Commission breach via Trivy supply chain attack, Cisco source code theft, and FortiClient EMS CVE-2026-35616 actively exploited in the wild.
  33. Cisco source code theft, Axios npm hijack spreading malware, and Iranian Pay2Key pseudo-ransomware campaigns.
  34. ShinyHunters breach of Europa.eu, Handala hack of FBI director Kash Patel's email, and Fortinet FortiClient EMS flaw exploited in the wild.
  35. Starbucks partner account breach, Iran-linked wiper attack on Stryker, and two Chrome zero-days exploited in the wild, plus CrackArmor Linux AppArmor flaws.
  36. The Stryker wiper attack by Handala, Michelin's Oracle EBS breach, critical n8n RCE flaws, and Microsoft's March Patch Tuesday fixes.
  37. Ericsson data breach, suspected FBI wiretap network breach, and Salesforce data theft campaign, plus APT28 espionage malware and Ivanti EPM exploitation.
  38. Drone strikes hit AWS data centers in UAE and Bahrain, AkzoNobel and LexisNexis breaches, and VMware Aria flaw CVE-2026-22719 exploited in the wild.
  39. The Oracle E-Business Suite breach at Madison Square Garden, APT28's MSHTML zero-day CVE-2026-21513, and North Korea's Contagious Interview npm campaign.
  40. Optimizely vishing breach, Vanta Diagnostics breach claimed by Everest ransomware, and actively exploited RoundCube Webmail flaws.
  41. 600+ FortiGate firewalls hit by AI-assisted Russian-speaking group; Grandstream CVE-2026-2329 root RCE; Predator hides iOS mic/camera alerts.
  42. Warlock ransomware breaches SmarterTools via unpatched SmarterMail, Conduent breach exposes Volvo customer data, Ivanti zero-days hit Dutch regulators.
  43. UNC3886 breaches Singapore's top telcos, Warlock exploits SmarterMail to hit SmarterTools, and a Firebase flaw exposes 300M Chat & Ask AI messages.
  44. The Polish energy grid cyberattack attributed to ELECTRUM, the eScan update server breach, and the FBI seizure of the RAMP cybercrime forum.
  45. Nike and SoundCloud breaches, ShinyHunters phishing of 100+ organizations, and the exploited Microsoft Office zero-day CVE-2026-21509.
  46. Covers a 149M credential leak, Fortinet FortiCloud SSO bypass exploitation, and ShinyHunters voice phishing of Okta, Microsoft and Google SSO.
  47. Under Armour ransomware breach, Fortinet FortiGate attacks, and Osiris ransomware hitting a Southeast Asian food franchisee, plus SmarterMail and Cisco …
  48. Zendesk ticket systems hijacked for global spam, Cisco zero-day CVE-2026-20045 exploited for RCE, and Fortinet FortiGate attacks via CVE-2025-59718 patch …
  49. CIRO data breach affects 750,000 people, Fortinet FortiSIEM flaw exploited in the wild, and Cisco AsyncOS zero-day patched.
  50. Kyowon ransomware, Fortinet FortiSIEM RCE exploits, the RedVDS takedown, and the AISURU/Kimwolf botnet disruption in this January 2026 brief.
  51. Covenant Health breach tied to Qilin ransomware, Fortinet firewalls hit by a five-year-old 2FA bypass, and $8.5M stolen from Trust Wallet users.
  52. Coupang's $1.17B breach compensation, Aflac's 22M-person data breach and the actively exploited MongoBleed MongoDB flaw.
  53. Stolen LastPass vault backups fuel crypto thefts through 2025; Fortinet FortiOS CVE-2020-12812 and Digiever DS-2105 Pro flaws actively exploited.
  54. The University of Sydney breach, Denmark water utility attack attributed to Russia, and actively exploited WatchGuard Fireware VPN flaw CVE-2025-14733.
  55. LKQ Oracle EBS breach, Cisco AsyncOS zero-day CVE-2025-20393 exploited by China-linked APT, and Kimwolf botnet hijacking 1.8M Android devices for DDoS.
  56. PDVSA cyberattack disrupts Venezuelan oil exports, SoundCloud breach hits 20% of users, and Urban VPN extension harvests AI chatbot conversations.
  57. React2Shell exploitation, Gladinet CentreStack hard-coded key attacks, WinRAR CVE-2025-6218 abuse, and Fortinet auth bypass patches in this security news brief.
  58. The 64M-record Barcelona data theft arrest, STAC6565 and QWCrypt attacks on Canadian firms, and Microsoft's December 2025 Patch Tuesday zero-days.
  59. The Oracle EBS extortion campaign hitting Cox, Canon and Mazda, the Shai-Hulud npm malware wave, and Harvard's voice phishing breach, plus new zero-days.
  60. ASUS router botnet Operation WrtHug, Cloudflare's six-hour outage, and Fortinet FortiWeb zero-days.
  61. The Pennsylvania AG ransomware breach by Inc Ransom, the WhatsApp contact discovery flaw exposing 3.5 billion numbers, and a FortiWeb zero-day under active …
  62. The Oracle E-Business Suite-linked Cl0p breaches including Logitech, Chrome and FortiWeb zero-days, and the record 15.72 Tbps Aisuru DDoS attack on Microsoft …
  63. JLR's £196M cyberattack losses, RondoDox botnet exploiting unpatched XWiki flaw, and guilty pleas over North Korean IT worker infiltration.
  64. Logitech and Washington Post breaches tied to Clop's Oracle E-Business Suite attacks, plus Fortinet FortiWeb zero-day exploited and added to CISA KEV.
  65. The Oracle EBS data theft fallout, Operation Endgame takedowns, and actively exploited Fortinet and WatchGuard flaws in today's cybersecurity news.
  66. F5 BIG-IP source code theft, Capita's £14M UK fine, and Clop's Oracle zero-day attack on Harvard.
  67. SonicWall SSL VPN compromises across 100+ environments, Oracle EBS zero-day malware attacks, and FBI seizure of BreachForums domains tied to ShinyHunters.
  68. FBI seizes BreachForums amid ShinyHunters Salesforce extortion; Gladinet CentreStack zero-day CVE-2025-11371 and Oracle EBS zero-day attacks actively exploited.
  69. The Jaguar Land Rover breach, a record NPM supply-chain attack, and Scattered Spider's $380M Clorox heist, plus Microsoft's 80 patches and Chinese APT activity.
  70. Kremlin-linked attack on a Norwegian dam, a partial FortiWeb auth-bypass exploit, and leaked ERMAC 3.0 Android banking trojan analysed.
  71. Pennsylvania AG office cyberattack, RansomHub-linked Manpower breach of 140,000, and Russian hackers breaching US court e-filing; plus Fortinet FortiSIEM flaw.
  72. The Allianz Life Salesforce data theft, unpatched Citrix NetScaler CitrixBleed 2 exposure, and the Charon ransomware campaign against Middle East public sector …
  73. NCSC attributes Microsoft 365 Authentic Antics malware to APT28, CrushFTP zero-day hijacks servers, and Google sues BADBOX 2.0 botnet operators.
  74. Co-op's 6.5M member data theft, UNFI's up to $400M sales hit and Louis Vuitton breaches tied to ShinyHunters.
  75. The McHire chatbot data exposure of 64M applicants, the Gravity Forms supply-chain backdoor, and Wing FTP Server and FortiWeb exploitation.
  76. The Qantas breach (5.7M customers), Ingram Micro's SafePay ransomware attack, and McDonald's Paradox.ai hiring platform exposure.
  77. Kettering Health and Optima Tax Relief ransomware breaches, Qilin exploiting Fortinet flaws, and 86M AT&T records reportedly sold on the dark web.
  78. Marks & Spencer customer data theft, Microsoft May 2025 Patch Tuesday with five zero-days, and SAP NetWeaver exploitation by ransomware gangs.
  79. SonicWall SMA exploitation, Apple iOS zero-days, a Fortinet symlink backdoor on 16,000+ devices, and the CrazyHunter ransomware targeting Taiwan.
  80. Gladinet Triofox/CentreStack RCE under active exploitation, Hertz breach via Cleo zero-day theft, and Fortinet zero-day exploit chatter.
  81. FortiGate read-only access after patching, Paper Werewolf's PowerModul implant, and PAN-OS GlobalProtect brute-force attacks.
  82. North Korean IT worker schemes, AkiraBot's AI-generated spam campaign against 420,000 sites, and a Lovable AI jailbreak flaw.
  83. Microsoft's 134-flaw Patch Tuesday with a zero-day, RansomEXX exploiting a Windows CLFS zero-day, and Mirai botnet attacks on TVT DVRs.