FBI Warns of Ongoing Attacks on Fortinet FortiGate SSL VPN Devices

Key points

• FBI issued a warning about active intrusions against Fortinet FortiGate systems.
• Attackers focus on internet-facing firewalls and SSL VPN gateways.
• A key effect is administrator lockout on compromised devices.
• No CVE is tied to the activity, so patch-only response is insufficient.
• The campaign is ongoing; exposure reduction and monitoring are urgent.

The FBI has issued an alert about an active campaign in which unidentified adversaries are going after Fortinet FortiGate equipment, particularly SSL VPN gateways. The warning does not name a specific threat group, and no CVE has been linked to the activity, according to the available information. That absence matters: defenders cannot simply wait for a vendor patch and assume the risk is handled.

According to the notice, the intruders are focusing on systems that are reachable from the internet, including firewalls and VPN appliances. In affected cases, administrators have found themselves locked out of the very devices they manage, which can complicate incident response and recovery. Exposed management interfaces and remote-access services appear to be the common factor.

K-12 districts and other government entities often run Fortinet gear at the network edge to support remote staff, students, and vendors. If an attacker gains control of a FortiGate or SSL VPN gateway, they may be able to alter access rules, create accounts, or disrupt connectivity. The lockout effect is especially damaging because it can prevent IT teams from using normal administrative paths to evict the intruder.

The situation is ongoing, so the risk is not theoretical. Even without a named vulnerability, attackers can take advantage of weak credentials, missing multi-factor authentication, unpatched firmware, or improperly exposed services. The FBI's warning should prompt immediate checks of internet-facing Fortinet devices rather than a one-time patch review.

No CVE means detection must rely on configuration hygiene, logs, and behavioral indicators. Administrators should inventory FortiGate and SSL VPN assets, limit who can reach management portals, enforce MFA, and review accounts and firewall rules for unexpected changes. Given the medium severity, priority should go to externally exposed devices first, followed by internal segmentation and continuous monitoring.

What to do now

1. Inventory every Fortinet FortiGate firewall and SSL VPN gateway, marking which ones are reachable from the public internet.
2. Restrict administrative access to trusted management networks or VPN, and disable unused remote-management services.
3. Enforce multi-factor authentication for all administrative and VPN accounts, and rotate credentials for privileged users.
4. Review local accounts, firewall policies, and SSL VPN settings for unauthorized changes; remove unknown accounts or rules.
5. Apply the latest Fortinet firmware and security guidance, even though no CVE is associated, and back up configurations before changes.
6. Collect and retain logs from edge devices, then monitor for lockouts, unexpected reboots, and configuration modifications.
7. Prepare an isolation and recovery plan for devices that are locked out, including out-of-band access and vendor support contacts.

Original source

BleepingComputer