Security News > 2024 > March > Exploit released for Fortinet RCE bug used in attacks, patch now
Security researchers have released a proof-of-concept exploit for a critical vulnerability in Fortinet's FortiClient Enterprise Management Server software, which is now actively exploited in attacks.
On Thursday, one week after Fortinet released security updates to address the security flaw, security researchers with Horizon3's Attack Team published a technical analysis and shared a proof-of-concept exploit that helps confirm if a system is vulnerable without providing remote code execution capabilities.
Those who want to use Horizon3's exploit code in RCE attacks must modify the PoC to use the Microsoft SQL Server xp cmdshell procedure to spawn a Windows command shell for code execution.
In February, Fortinet patched another critical RCE bug in the FortiOS operating system and FortiProxy secure web proxy, saying it was "Potentially being exploited in the wild."
It's also worth noting that Fortinet security vulnerabilities are frequently used to gain unauthorized access to corporate networks for ransomware attacks and cyber espionage campaigns, often using zero-day exploits.
News URL
Related news
- Zero-Day Alert: Google Releases Chrome Patch for Exploit Used in Russian Espionage Attacks (source)
- Old Fortinet flaws under attack with new method its patch didn't prevent (source)
- MITRE Caldera RCE vulnerability with public PoC fixed, patch ASAP! (CVE-2025–27364) (source)
- Ransomware gangs exploit Paragon Partition Manager bug in BYOVD attacks (source)
- Hackers Exploit Paragon Partition Manager Driver Vulnerability in Ransomware Attacks (source)
- Hackers Exploit AWS Misconfigurations to Launch Phishing Attacks via SES and WorkMail (source)
- PHP-CGI RCE Flaw Exploited in Attacks on Japan's Tech, Telecom, and E-Commerce Sectors (source)
- Critical PHP RCE vulnerability mass exploited in new attacks (source)
- Apple Releases Patch for WebKit Zero-Day Vulnerability Exploited in Targeted Attacks (source)
- New SuperBlack ransomware exploits Fortinet auth bypass flaws (source)