Patch procrastination leaves 50,000 Fortinet firewalls vulnerable to zero-day

Fortinet customers need to get with the program and apply the latest updates as nearly 50,000 management interfaces are still vulnerable to the latest zero-day exploit. Data from the Shadowserver Foundation shows 48,457 Fortinet boxes are still publicly exposed and haven't had the patch for CVE-2024-55591 applied, despite stark warnings issued over the past seven days. The situation has not improved over time either. Shadowserver began tracking the number of exposed appliances on January 16, two days after the CVE identifier for the zero-day was issued, and even then just shy of 52,000 instances were vulnerable. Customers in Asia are the most exposed, with 20,687 vulnerable firewalls still reachable over the internet, while North America and Europe trail with 12,866 and 7,401 respectively. A reminder to those still dawdling over patching this one, Fortinet confirmed CVE-2024-55591 is being actively exploited and it's also on CISA's KEV catalog. Don't be like the 86,000-plus customers who didn't patch the last one. Speaking to The Register about the issue last week, Arctic Wolf Labs' lead threat intelligence researcher Stefan Hostetler said exploits have been widespread, opportunistic, and date back to December. He added that once they've pwned their target, attackers appear to be stealing credentials and using them to worm their way through the victim's network with admin privileges. The rest of the details are still being gathered, but - needless to say - an intruder with ad...