Fortinet Warns of Persistent Read-Only Access to FortiGate Devices Despite Patching

Fortinet has issued a warning that attackers can maintain read-only access to FortiGate devices even after the initial vulnerability used for the breach has been patched. Cybercriminals are exploiting known vulnerabilities in FortiGate, such as CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762. This technique allows attackers to bypass applied patches by using symbolic links to maintain limited access to compromised systems.