FortiWeb

k0t Operators Breach Corporate Firewalls and VPNs Exposing Over 70,000 Credentials

Group-IB and NyxLab detailed a campaign by the operator k0t targeting exposed firewalls and VPN portals. The operation collected more than 70,000 credentials from network devices and LDAP directory extractions across 84 compromised appliances. Initial access relied on CVE-2025-64446 directory traversal in FortiWeb, CVE-2026-0257 authentication bypass in Palo Alto GlobalProtect, and password brute-forcing against FortiGate devices. Attackers then leveraged CVE-2019-6693 to decrypt FortiOS configuration secrets and chained the noPac technique to reach domain administrator privileges. Persistence was achieved through MeshCentral, AdaptixC2, Atera, AnyDesk, and ngrok, while Rclone handled data exfiltration to cloud storage. Victims appeared on the Qilin and The Gentlemen leak sites, suggesting the operators likely act as initial-access brokers rather than direct ransomware affiliates.

Fortinet Patches Critical Authentication Bypass in FortiWeb Allowing Login with Random Credentials

Fortinet has released security updates addressing multiple vulnerabilities across FortiWeb, FortiManager, and FortiClient products. The most severe issue, tracked as CVE-2026-26035, affects FortiWeb and carries a CVSS score of 8.8. The flaw occurs when administrative accounts configured with remote RADIUS authentication use the wildcard option, which is disabled by default. Under these conditions, an unauthenticated remote attacker can gain administrative access to the web application firewall by supplying arbitrary usernames and passwords. Successful exploitation grants full control over the FortiWeb instance, potentially compromising web application security. The vulnerability impacts FortiWeb versions 8.0, 7.6, 7.4, 7.2, and 7.0, with fixes available in versions 8.0.3, 7.6.7, 7.4.12, and 7.2.13. No active exploitation of the authentication bypass flaws has been observed so far, but the risk of remote administrative access makes immediate patching essential for exposed appliances.