FortiManager critical vulnerability under active attack

Fortinet disclosed CVE-2024-47575, a critical (CVSS 9.8) missing-authentication vulnerability in FortiManager that allows remote unauthenticated code execution; the flaw is being actively exploited in the wild, CISA added it to its Known Exploited Vulnerabilities catalog, and investigators (Mandiant) attribute mass exfiltration of FortiGate configuration data to a new cluster tracked as UNC5820. Fortinet has published IOCs (including four malicious IPs), mitigation guidance and urged immediate patching of affected FortiManager instances.