CVEs
A vulnerability in multiple Fortinet products gives an unauthenticated remote attackers root access to its core product’s administrative interface – and the vulnerability has been exploited in the wild the company warned. Given exploitation the company has warned customers to check for Indicators of Compromise. https://twitter.com/Horizon3Attack/status/
Exploited for a month. No detection in Sentinel, no patch yet. Mitigate urgently.
CVSS 9.8 vulnerability added to CISA "known exploited" catalogue
Well a Metasploit module has been available for a while...
Should customers start demanding more?
Mean-time-to-Patch, meanwhile? 205 days...
Zero, to SYSTEM and creating new admin accounts, in a heartbeat.