CPE
Fortinet FortiOS and related products: Format string vulnerability in FGFM service (CVE-2024-23113)
1 TTP 1 CVEA format string vulnerability (CVE-2024-23113) in the FortiGate FGFM service on TCP port 541 allows unauthenticated remote code execution via specially crafted input.
Vulnerabilities in Siemens RUGGEDCOM APE1808 via Fortinet Integration
2 TTPs 2 CVEsSiemens RUGGEDCOM APE1808 devices are impacted by multiple vulnerabilities (CVE-2026-23573, CVE-2026-59839) within the integrated Fortinet NGFW software, potentially allowing remote code execution or filesystem deletion.
Gunra Ransomware Gang Exploitation of Fortinet Appliances
4 TTPs 2 CVEsThe Gunra ransomware-as-a-service group is leveraging critical Fortinet vulnerabilities (CVE-2024-55591 and CVE-2025-24472) to gain initial access, hijack VDI sessions, and bypass multi-factor authentication in attacks against critical infrastructure.
Qilin Ransomware Claims New Victim in Agriculture and Food Production Sector
2 rules 13 TTPs 5 CVEs 178 IOCsThe Qilin ransomware group, active since July 2022 and utilizing Golang, has claimed a new victim, Danone (International Delights) in the US Agriculture and Food Production sector, employing double extortion tactics involving data encryption and threatened data release.
Multiple Critical Vulnerabilities in Fortinet Products Lead to RCE and Data Exposure
2 rules 4 TTPs 3 CVEs 6 IOCsMultiple critical vulnerabilities (CVE-2025-67862, CVE-2026-25089, CVE-2026-49938) have been discovered across Fortinet products including FortiOS, FortiPortal, FortiProxy, and FortiSandbox, enabling unauthenticated attackers to achieve remote arbitrary code execution and compromise data confidentiality.
DNS Kerberos Coercion Attempt Detection
3 rules 3 TTPs 4 CVEs 4 IOCsThis brief details the detection of DNS-based Kerberos coercion attacks, where adversaries inject marshaled credential structures into DNS records to spoof SPNs and redirect authentication, as seen in CVE-2025-33073, using Suricata and Sysmon event ID 22.