Fortinet Sounds Alarm on Persistent Exploitation Method in FortiGate Devices

A New Layer of Cyber Threat: Hidden Persistence After Patching

Fortinet, a leading cybersecurity firm, has issued a critical warning about a stealthy post-exploitation technique that allows threat actors to maintain read-only access to FortiGate VPN devices — even after the original vulnerabilities used for access have been patched. This persistent backdoor leverages symbolic links in the system’s file structure, enabling attackers to remain hidden in plain sight, long after administrators believe their systems have been secured.

In an email campaign sent out earlier this week, Fortinet alerted customers under the subject line “Notification of device compromise – FortiGate / FortiOS – Urgent action required .” The notification, designated TLP:AMBER+STRICT, revealed that numerous devices were found compromised based on FortiGuard telemetry.

The concerning part? These threats are not linked to any new vulnerability, but rather to artifacts left behind by hackers from previous successful breaches. Fortinet specifically cited exploits such as CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762. Despite these vulnerabilities being patched, a leftover symbolic link allows attackers to retain low-level access to critical system areas.

Key Points (approx. 30 lines):

Fortinet issued urgent warnings this week to customers about compromised FortiGate and FortiOS devices.
Threat actors exploited older vulnerabilities but maintained read-only access even after those exploits were patched.
The technique involves creating symbolic links in the language files folder that point to the device’s root file system.
These symbolic links provide persistent access through the SSL-VPN web panel, even after administrative intervention.
The symbolic link is created in the user filesystem, evading standard detection methods during upgrades or audits.
Fortinet stated the persistence method is not related to a new vulnerability, but a residual effect of earlier breaches.
The vulnerabilities involved include CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762.
CERT-FR reported this technique has been used since early 2023, with a significant number of compromised devices in France.
The U.S. CISA (Cybersecurity and Infrastructure Security Agency) echoed the warning and encouraged incident reporting.
Fortinet advises users to upgrade to the latest FortiOS versions (7.6.2, 7.4.7, 7.2.11, 7.0.17, 6.4.16).
Admins are also urged to check configurations, look for unexpected changes, and reset compromised credentials.
CERT-FR suggests isolating infected devices, resetting all security secrets, and checking for lateral movement within networks.
The exploitation method provides a clear example of the evolving sophistication of post-exploitation techniques.
Threat actors no longer rely solely on active vulnerabilities but can maintain passive, hidden access long-term.
This situation underscores the need for continuous monitoring, forensic analysis, and zero-trust principles in cybersecurity.

What Undercode Say:

The Fortinet incident exposes an alarming shift in the cyber threat landscape — from one-time vulnerability exploitation to long-term strategic persistence. It reveals that even when patches are applied, remnants of past breaches can remain undetected, allowing attackers to maintain surveillance-level access without needing to re-engage actively.

This tactic—leveraging symbolic links to maintain read-only access—shows a deep understanding of FortiOS architecture by threat actors. By injecting symbolic links into the folder used for VPN language files, attackers cleverly manipulate a seemingly benign part of the system to serve as a covert gateway to sensitive configurations. These links are not just shortcuts; they are quiet observers embedded in the root filesystem that survive security patches and continue to feed intel back to threat actors.

The read-only nature of the access may seem harmless at first glance. However, access to configuration files and system settings can be used for future exploitation, credential harvesting, reconnaissance, and even social engineering campaigns. It’s not just about what attackers can do today, but what they’re learning to use tomorrow.

This scenario underscores a dangerous truth: traditional patching is no longer enough. Systems must be regularly audited for artifacts and unusual behaviors, even in the absence of active threats. Security teams must pivot toward advanced forensics, behavioral analysis, and robust anomaly detection, especially for devices exposed to the internet.

The Fortinet alert also highlights the critical role of security telemetry and proactive vendor communication. Without FortiGuard’s monitoring tools detecting unusual access patterns, many customers might have remained unaware of their ongoing exposure. This reinforces the value of investing in not just software solutions but also in a full security ecosystem that includes vendor-backed intelligence and rapid incident response capabilities.

For enterprise environments, especially those relying heavily on VPN access and remote administration, this revelation should trigger an immediate re-evaluation of security practices. Firewalls and VPNs, while foundational for protection, also become high-value targets. They demand the highest levels of scrutiny.

Additionally, the cross-continental nature of this exploit, reaching from France to potentially the U.S., indicates coordination and scale. It’s not just isolated attacks — it’s a campaign. The integration of international CERTs and CISA into the response narrative shows how vital collaboration is in the modern threat landscape.

Ultimately, cybersecurity is evolving into a battle of persistence — who can outlast and outmaneuver the other, day after day, patch after patch. In this climate, security must be treated not as a checklist but as a living process of adaptation and vigilance.

Fact Checker Results:

✅ Fortinet confirmed the issue does not involve a new vulnerability.
✅ CERT-FR linked the exploitation method to a long-running campaign since early 2023.
✅ The advisory urges upgrades, forensic analysis, and credential resets to mitigate risk.