FortiGate firewalls are the security perimeter for many enterprise networks — compromise of the firewall itself can give an attacker full visibility into and control over network traffic, bypassing all downstream security controls. An attacker who reaches this position can intercept communications, pivot to internal systems, and disable defenses without detection. Organizations in regulated industries relying on FortiGate for network segmentation may face compliance exposure if the firewall is found to have been compromised during an audit or breach investigation.
You Are Affected If
You run FortiOS 7.2.0–7.2.11, 7.4.0–7.4.8, or 7.6.0–7.6.3 on FortiGate appliances in production
Your FortiGate manages one or more FortiAP, FortiExtender, or FortiSwitch devices via the CAPWAP protocol
Any managed FortiAP, FortiExtender, or FortiSwitch device has been compromised or is untrusted
You have not yet applied the patches specified in FortiGuard PSIRT advisory FG-IR-26-123
CAPWAP management traffic is not isolated from other network segments, increasing lateral movement risk
Board Talking Points
A patched vulnerability in our Fortinet firewall software could allow an attacker who compromises a Wi-Fi access point or network switch to then take control of the firewall itself.
IT security should apply Fortinet's available patches to all affected firewall appliances within the next patch cycle, prioritizing any environments where managed access points or switches are deployed.
Without patching, a single compromised edge device could become a path to full network access, undermining all firewall-based security controls.
