What happened
The FBI’s advisory confirms that threat actors are exploiting the FortiBleed vulnerability (CVE‑2022‑42475) in Fortinet FortiGate firewalls. SOCRadar telemetry shows 86,644 devices across 194 organizations have been compromised, allowing unauthenticated remote code execution and persistent back‑door installation.
Why it matters for trust and compliance
- This incident highlights the control objective of robust vulnerability management—continuous detection, timely patching, and auditable proof of remediation—critical for maintaining trust and passing compliance assessments.
- Continuous monitoring of patch status provides real‑time evidence for audit readiness.
- Documented remediation workflows satisfy the vulnerability‑management control across multiple frameworks.
Who is affected
Telecommunications Financial Services Healthcare Enterprises using FortiGate network appliances
Recommended actions
- Run an inventory of all FortiGate devices and compare firmware versions to Fortinet’s advisory.
- Apply the latest FortiOS patches (≥ 7.2.4) that remediate CVE‑2022‑42475.
- Integrate vulnerability scan results into a continuous control‑monitoring solution.
- Archive patch‑deployment logs as defensible evidence for auditors.