Unit 42: FortiManager compromise exposed 500+ FortiGate firewalls in telecom attack

Palo Alto Networks' Unit 42 described an intrusion where a single compromised FortiManager gave suspected state-sponsored attackers configuration, credential and trust data for more than 500 FortiGate firewalls in a telecom network. Experts urge treating the management plane as critical infrastructure with isolation, rapid revocation and independent recovery.

• One FortiManager exposed data on 500+ FortiGate devices and their networks
• ZoomEye counted 1,012,298 FortiGate product matches as of October 27, 2026
• Recommended controls: isolation, certificate revocation, artifact preservation, independent recovery
• Closure requires reconciling all managed devices and replacing compromised trust