FortiManager Missing Auth Bug Lets Rogue Devices Steal 500 Firewall Keys

Attackers gained unauthorized access to more than 500 FortiGate firewalls by compromising a single FortiManager appliance used by a telecommunications managed service provider. According to Palo Alto Networks Unit 42, the intrusion began in September 2024 and resulted in the exfiltration of running configurations, cryptographic material, and database files. The stolen data included credentials for firewalls protecting both the provider’s own infrastructure and the networks of its clients. This breach allowed threat actors to deploy the PEERSTITCH implant, which evaded detection within FortiOS memory, as RedTeam Tribune reported on October 16, 2026.

How it unfolded

• In September 2024, attackers exploited CVE-2024-47575 against a centralized FortiManager appliance to achieve initial compromise.
• Within minutes, they registered a rogue virtual device over TCP port 541 without authentication.
• The group extracted an archive containing serial numbers, public IP addresses, routing tables, and VPN credentials for every managed firewall.
• Using decrypted credentials from the stolen files, attackers established unauthorized SSL/VPN sessions into internal network management segments.

Who is affected

The primary victim was a telecommunications managed service provider whose FortiManager appliance was breached. The compromise exposed more than 500 downstream FortiGate firewalls that protected the target’s infrastructure and the networks of its clients. According to Unit 42, the investigation covered only the provider’s own environment, not the downstream clients. The attackers obtained private keys and configurations for firewalls belonging to organizations that were unaware of the breach.

The fix

No patch or update has been confirmed by the vendor in the source material. Organizations should verify whether their FortiManager appliances are vulnerable to CVE-2024-47575. Until a fix is available, monitor for unauthorized device registrations and unexpected configuration exports. Isolate management appliances from external networks to reduce exposure.

What made it possible

Teams usually rely on centralized management platforms to streamline firewall configuration and monitoring. When these platforms lack proper authentication controls, attackers can register rogue devices and extract sensitive data. This weakness serves as an initial access vector, allowing threat actors to pivot from a single compromised appliance to hundreds of downstream devices. Check whether your management interfaces require strong authentication and limit external access to prevent unauthorized device registration.

Background: Firewalls

A firewall is a network security device that monitors incoming and outgoing traffic. It applies a set of rules to allow or block data packets. This creates a barrier between trusted internal networks and untrusted external ones, stopping unauthorized access before it reaches your servers.

Read the full guide: How Firewalls Work: The Mechanics Behind Network Traffic Control

What to do and how to stay safe: FortiManager

• Monitor FortiManager logs for unauthorized device registrations, especially on TCP port 541.
• Rotate all credentials and cryptographic keys for managed firewalls after any management system breach.
• Restrict external access to FortiManager appliances to trusted IP addresses only.
• Once the vendor provides an update, apply patches to FortiManager and all managed FortiGate devices.

Step-by-step guide: DDoS Attack Mechanics: Answers to 10 Critical Questions

General security guidance from the RedTeam Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What vulnerability did attackers exploit to compromise the FortiManager appliance?

Attackers exploited CVE-2024-47575, known as FortiJump, which allowed unauthenticated registration of a rogue virtual device.

How many firewalls were exposed in this breach?

More than 500 managed FortiGate firewalls were exposed, protecting both the provider’s infrastructure and client networks.

Did the attackers deploy any malware during this intrusion?

Yes, attackers deployed the PEERSTITCH implant to maintain stealthy access and evade detection within FortiOS memory.