Fortinet Zero-Day Bug May Lead to Arbitrary Code Execution

A threat actor posted on a Dark Web forum claiming a FortiGate zero-day that enables unauthenticated remote code execution and full control of affected devices, including exfiltration of FortiOS configs and credentials. Fortinet concurrently released an advisory describing exploitation of known FortiOS/FortiProxy vulnerabilities (CVE-2022-42475, CVE-2023-27997, CVE-2024-21762), remediation guidance for those CVEs, and reports indicate over 14,000 devices may have been compromised, while clear mitigations for the alleged zero-day are not provided.