Unseen Infiltration: Hackers Persist Despite Fortinet Patch with Clever Exploit

Hackers keep access to Fortinet devices after patching

Summary:

• Fortinet’s Latest Challenge: Attackers kept access to some FortiGate devices even after the original flaws were patched.
• How They Stayed In: A hidden symbolic link left behind after earlier break-ins gave read-only access.
• The FortiOS Flaws: The original intrusions used older, already patched FortiOS vulnerabilities.
• Protection Strategies: Fortinet urges upgrades to fixed FortiOS versions and a review of device configurations.
• Industry Implications: Patching alone does not remove an attacker who is already inside.

What Fortinet disclosed

Fortinet warned in April 2025 that attackers had found a way to keep access to some FortiGate devices after customers patched the bugs used to break in. The problem is not a new vulnerability. It is a persistence trick left behind during earlier compromises.

How the attackers stayed in

In earlier attacks, criminals exploited known FortiOS flaws on devices with SSL-VPN enabled. While inside, they planted a symbolic link connecting the user filesystem to the root filesystem in a folder used to serve SSL-VPN language files. That link survived later patches and gave the attackers read-only access to files on the device, including configurations.

The FortiOS flaws involved

The original intrusions relied on vulnerabilities Fortinet had already fixed. Devices patched promptly were not affected, but those compromised before patching could still carry the hidden link.

Patching closes the door. It does not evict someone who already got in.

Upgrade and check the device

Fortinet released FortiOS 7.6.2, 7.4.7, 7.2.11, 7.0.17 and 6.4.16, which remove the malicious link and stop SSL-VPN from serving it. Customers should upgrade.

Fortinet and CISA also advise reviewing device configurations as if they were exposed and resetting any credentials an intruder could have read. Disabling SSL-VPN until the upgrade is done cuts risk further.

What defenders should take from it

Pair patching with compromise checks. If a device sat exposed during active exploitation, assume someone left something behind.

What it means for edge devices

VPN gateways and firewalls are favorite targets because they sit on the internet edge. Attackers who get in try to stay in, and they plan for the patch.

Sharing indicators quickly, as Fortinet and national agencies did, helps.

What to watch

Expect more attackers to build persistence into their intrusions on edge devices. Teams that run them should upgrade, hunt for leftovers and rotate credentials after any period of exposure.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.