Patch todayFortinet FortiGateFirewalls, VPNs & network gear

Attackers are hijacking unpatched FortiGate firewalls at scale

Who's affected: Businesses with Fortinet firewalls running FortiOS, plus FortiSwitchManager and FortiSASE.
Under attack?: Yes, widely. Researchers counted more than 30,000 targeted devices and 178 confirmed infections.
What to do: Update FortiOS and confirm the new version is running. Block UDP ports 5246 to 5249 from untrusted networks, and check for the signs of compromise in Fortinet's advisory.
Fixed in: FortiOS 7.6.47.4.97.2.127.0.18
CISA deadline: Federal agencies must fix this by Sep 12, 2026. Everyone else should treat that as a ceiling, not a target.

CVE-2025-25249Chance of attack in 30 days: 4% (EPSS)Listed Sep 9, 2026Source: Resecurity ↗

Fortinet scorecard: every exploited Fortinet flaw →

Client notice ready to send

Fill in the bracketed parts, then paste into an email to your clients or team.

Subject: Security update: Fortinet FortiGate

Hi [Client name],

Attackers are actively exploiting a security flaw in Fortinet FortiGate.

Who's affected: Businesses with Fortinet firewalls running FortiOS, plus FortiSwitchManager and FortiSASE.

What we're doing: [We're checking your systems now and will have the fix in place by DATE.]

What to do: Update FortiOS and confirm the new version is running. Block UDP ports 5246 to 5249 from untrusted networks, and check for the signs of compromise in Fortinet's advisory.

Fixed in: FortiOS 7.6.4, 7.4.9, 7.2.12, 7.0.18
Reference: CVE-2025-25249 – https://www.resecurity.com/en/blog/article/cisa-kev-alert-cisco-citrix-and-fortinet-vulnerabilities-under-active-exploitation

We'll confirm once everything is updated. Reply here with any questions.

[Your name]

Attackers are hijacking unpatched FortiGate firewalls at scale

Also under attack in Firewalls, VPNs & network gear