FortiGate Firewalls Under Attack: Hackers Exploit Critical Vulnerabilities to Steal Corporate Credentials

Cybercriminals exploited FortiGate vulnerabilities in 2026, breaching networks and stealing credentials. Update firmware now to stay secure.

By Content Team

Mar 15, 2026

ON THIS PAGE

Cybercriminals launched a coordinated attack wave in early 2026, exploiting three critical FortiGate firewall vulnerabilities to breach enterprise networks. The attacks leveraged CVE-2025-59718 and CVE-2025-59719 (both rated 9.8 severity), which allow hackers to gain admin access using fake SAML tokens, plus a zero-day flaw CVE-2026-24858 that enabled login through attackers' own FortiCloud accounts.

Once inside, attackers extracted firewall configurations and decrypted embedded service account credentials for Active Directory systems. In one case, hackers maintained access for two months undetected, creating fake admin accounts and deploying remote access tools. They ultimately stole domain controller databases containing all user passwords.

Fortinet has released patches, but organizations must immediately update firmware, rotate all LDAP credentials, and strengthen firewall monitoring to prevent further breaches.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?