FORTINET WARNS OF NEW CRITICAL FORTIMANAGER FLAW USED IN 0-DAY ATTACKS

Summary from the TLDR InfoSec newsletter

Fortinet has announced a new critical 9.8 severity CVE in the FortiManager API that allows for stealing credentials, sensitive files, and IP addresses. The vulnerability lies in an authentication bypass in the FortiManager FGFM API. Fortinet has confirmed that the vulnerability is being actively exploited and has provided updated versions, mitigations, and IoCs.