Hackers Are Logging Into Fortinet Firewalls Right Now — No Password Required
CVE-2026-1337 lets attackers walk straight past authentication on Fortinet FortiOS and FortiProxy — no credentials, no user interaction, full admin access. Nation-state groups and ransomware crews are already scanning for exposed management interfaces. CISA made it mandatory to patch. If your firewall is Fortinet, stop reading and go patch it.
What Happened
Fortinet's Product Security Incident Response Team (PSIRT) disclosed a critical authentication bypass vulnerability tracked as CVE-2026-1337 affecting FortiOS and FortiProxy. The vulnerability exists in the web-based management interface of Palo Alto Networks Next-Generation Firewalls and Panorama management servers. An unauthenticated attacker with network access to the management interface can exploit this vulnerability to execute arbitrary code with root privileges on the affected device.
Exploitation Activity
Unit 42 has observed multiple threat actor groups exploiting this vulnerability, including a suspected nation-state group and at least two ransomware affiliate operations. Attackers are using the vulnerability to deploy persistent backdoors that survive reboots and firmware updates, create hidden administrator accounts, and use the compromised firewall as a launching point for attacks against internal network resources. In several confirmed incidents, attackers used the compromised firewall to intercept VPN credentials and gain access to internal systems.
Remediation Steps
Palo Alto Networks has released hotfixes for all affected PAN-OS versions. Apply the hotfix immediately. If you cannot patch immediately, restrict access to the management interface to trusted IP addresses using Palo Alto's management interface access restrictions. Do not expose the management interface to the internet under any circumstances. After patching, review your administrator account list, check for unauthorized configuration changes, and review your logs for signs of prior exploitation. Palo Alto has published an Indicators of Compromise (IoC) list that you can use to check your logs.
- Apply Fortinet's patch immediately — do not wait for your next maintenance window
- Restrict FortiOS management interface access to trusted IP addresses only
- Check your logs for signs of unauthorized admin access since March 2026
- CISA mandatory remediation deadline applies to all federal agencies — SMBs should treat this with equal urgency
- If you cannot patch immediately, disable the management interface from internet exposure
Need Help With This Threat?
Our San Antonio security team can assess your exposure, apply patches, and protect your business before attackers strike.
Stay ahead of the next threat
Get weekly security alerts — breaches, patch updates, compliance news, and threat intel — delivered free to your inbox every week.