Fortinet in the Crosshairs: FortiOS SSL-VPN and the FortiManager Jump

FortiGate appliances run FortiOS and provide perimeter firewalling plus SSL-VPN remote access; FortiManager is the central management plane holding configurations and credentials for fleets of FortiGate devices. Both are necessarily reachable — SSL-VPN from the internet, FortiManager via the FGFM protocol — so a FortiGate compromise exposes the edge while a FortiManager compromise exposes an entire managed estate at once. Fortinet gear has seen repeated SSL-VPN remote-code-execution zero-days, a management-plane authentication bypass, and the FortiManager “FortiJump” flaw.

Key Exploited CVEs

CVE-2024-21762 and FortiJump (CVE-2024-47575) are the best-corroborated CISA KEV entries; confirm the KEV status of the others against the live catalogue and Fortinet’s FG-IR advisories. T1190 T1078 T1136

Who Exploited Them

• Fortinet attributed use of the SSL-VPN overflow bugs (CVE-2022-42475, CVE-2023-27997) to China-nexus Volt Typhoon activity deploying the “Coathanger” RAT — a vendor assessment, treated as hedged.
• FortiJump (CVE-2024-47575) exploitation from mid-2024 across 50+ FortiManager devices was tracked by Mandiant as UNC5820 (configuration and credential exfiltration).
• In January 2025 the “Belsen Group” leaked configurations and VPN credentials for roughly 15,000 FortiGate devices; the data appears to have been exfiltrated via CVE-2022-40684 back in October 2022.

Detection & Mitigation

• Patch to the fixed FortiOS/FortiManager builds named in the relevant FG-IR advisories, prioritising any SSL-VPN or management-plane flaw; if patching is delayed, disable SSL-VPN and restrict FortiManager FGFM and admin access to known management IPs via local-in policy.
• For CVE-2022-40684 and the Belsen leak, assume leaked configs and VPN credentials are burned — rotate all passwords, pre-shared keys and certificates on any device exposed or unpatched in 2022.
• Audit admin accounts for unauthorised additions and review config-change and VPN-login logs for anomalous admin sessions; hunt for FGFM connections from unexpected sources and config pulls off FortiManager.
• Export logs off-box, since on-appliance logs can be tampered with or rotated out.