A central FortiManager is convenient because it concentrates control. The telecom intrusion described by Unit 42 shows the other side of that architecture: compromise of one management appliance gave suspected state-sponsored attackers configuration, credential, address, and trust information for more than 500 FortiGate firewalls.

Boards and engineering leaders should use that fact to review concentration risk, recovery authority, and evidence of containment.

Decide which systems are critical infrastructure

The incident moved through three assets: a FortiManager, managed FortiGate firewalls, and the networks behind those firewalls. The central appliance could push policy and retrieve configuration. Its trust material could support management impersonation. Its database held the relationships that made bulk action possible.

That makes the management plane a critical dependency, even if it does not carry user traffic. The decision for leadership is whether the platform receives critical-infrastructure treatment in patching, isolation, monitoring, access control, backup, and incident exercise.

Measure the blast radius with actual relationships

A raw product count is not a portfolio inventory. ZoomEye found 1,012,298 FortiGate product matches in its stored October 27, 2026 observation. Country samples found 124,875 in the United States, 114,508 in China, 27,694 in Germany, and 15,728 in Japan.

Those figures show that the external population is broad. The organization-specific blast radius remains a matter of enumerated management relationships. Leaders should ask for the number of downstream devices, the number of owners and clients, the credentials and certificates in the central platform, and the percentage of devices that can be reached through an approved management path.

The report should distinguish confirmed compromise from exposed material. Unit 42 found configuration and credential exposure for client networks, yet did not examine those client networks. Patching the provider's system does not by itself prove that every downstream environment has been assessed.

Fund the four recovery controls

The first control is isolation of the management plane. FortiManager should accept enrollment and administrative access only from approved networks and identities. Egress should be visible and limited, including traffic to appliance management services.

The second is rapid revocation. A team needs a tested process to replace management certificates, private keys, administrator credentials, VPN identities, and automation secrets. A successful password reset is incomplete if old certificates or sessions continue to work.

The third is artifact preservation. Preserve FortiManager memory, database snapshots, configuration revisions, enrollment history, and logs before cleanup. Unit 42's report shows that attackers may remove scripts, accounts, and crash logs, so waiting until after a rebuild can erase the evidence needed for scope.

The fourth is independent recovery. The ability to restore or validate a firewall without trusting the compromised management platform matters. Maintain out-of-band access, known-good configuration records, and an exercise that proves operators can reach and verify devices during a management outage.

Use external discovery as a completeness check

ZoomEye can show whether an external FortiGate or FortiManager appears outside the owner's asset register. The product and port results need to remain separate: a visible product is not proof of an affected version or an open management interface.

The useful metric is not the number of internet matches. It is the percentage of external matches that the owner can map to an accountable device and current management record. That metric improves inventory coverage and makes an incident handoff faster.

Set a completion standard

An executive report can require five explicit outcomes before accepting closure: all managed-device relationships reconciled, compromised trust replaced, dependent credentials and sessions invalidated, configurations compared with preserved history, and downstream client environments either assessed or flagged as outside scope.

The final statement should identify remaining risk. If unsupported devices, legacy certificate bundles, or uninspected client networks remain, the organization should say so and assign the next action.

The Fortinet CVEs require immediate technical work. The management architecture decides whether one compromised appliance can remain a durable path into hundreds of networks after its direct vulnerability is fixed. Leadership owns that architecture decision.

References

  • Unit 42, "Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant": https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/

  • SecurityWeek incident report: https://www.securityweek.com/exploited-fortinet-bug-linked-to-stealthy-fortigate-implant-in-telecom-hack/

  • CVE-2025-61624: https://www.cve.org/CVERecord?id=CVE-2025-61624

  • Fortinet FG-IR-26-122: https://fortiguard.fortinet.com/psirt/FG-IR-26-122

  • Fortinet FG-IR-24-423: https://www.fortiguard.com/psirt/FG-IR-24-423

  • CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog