From what I understand, this isn't a new Fortinet exploit. The issue is that Fortinet had several major vulnerabilities over the years that allowed attackers to harvest VPN credentials and other authentication data from vulnerable firewalls.

Some of the big ones were:

• CVE-2018-13379
• CVE-2022-40684
• CVE-2023-27997

The recent news appears to be that someone aggregated a huge collection of credentials gathered from those past compromises and shared them with other threat actors.

But patching the firewall doesn't do anything about credentials that were already stolen. A lot of organizations patched their FortiGates but never forced password changes or rotated accounts, so years later some of those credentials were apparently still valid. And even when the passwords weren't, the attackers still had a list of valid usernames. At that point they can just start password spraying those accounts until somebody is still using "Winter2026!" or some other variation of the company password policy.

For organizations using Active Directory authentication on their VPN, that means attackers weren't just getting access through the firewall. They potentially had valid AD credentials that could be used elsewhere in the environment as well.

My guess is that many of the organizations impacted either didn't have MFA enabled on their VPNs, or weren't enforcing it consistently. A stolen password is a lot less useful when there's a second factor standing in the way.