Fortinet warns of active campaign exploiting bug in FortiManager products

Fortinet and Mandiant report active exploitation of a critical FortiManager zero-day (CVE-2024-47575, CVSS ~9.8) that permits unauthenticated remote code execution and management of connected FortiGate devices; investigations have identified dozens of affected organizations, credential and configuration exfiltration by actor cluster UNC5820, and widespread internet-exposed devices, prompting CISA and vendors to urge patching and mitigations.