Forti Gate Devices Exploited to Breach Networks and Steal Service Account Credentials
Summary: SentinelOne reported a campaign in which threat actors exploit FortiGate NGFW appliances, via vulnerabilities such as CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858 or weak credentials, to extract configuration files holding service account credentials and network topology data, targeting healthcare, government, and managed service provider environments. In one incident an attacker breached a FortiGate appliance in November 2025, created a local administrator account named "support" with four unrestricted firewall policies, and in February 2026 authenticated to Active Directory with clear-text fortidcagent service account credentials and enrolled rogue workstations; a second case in late January 2026 moved from firewall access to deploying Pulseway and MeshAgent and exfiltrating NTDS.dit and the SYSTEM registry hive to 172.67.196[.]232 over port 443.
What you should know: Both incidents shared a lack of adequate logging on the firewalls, so investigators could not determine how or when the attackers first gained access - SentinelOne recommends at least 14 days of log retention with all logs sent to a SIEM, because an attacker who deletes local logs removes your only record of the entry point.