InfoSecBulletin Cybersecurity for mankind
A threat actor is allegedly offering a private remote code execution exploit for Fortinet FortiGate SSL VPN appliances, claiming that FortiOS 7.2.x and 7.4.x are affected. The listing has not been independently verified and does not confirm the existence of a new FortiGate zero-day vulnerability.
The ad by Dark Web Intelligence talks about a “1-day” exploit that lets someone run code from far away.
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Contract and server dispute brought down Bangladesh’s digital payment
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
The exploit is reportedly intended for initial access against exposed FortiGate SSL VPN services. The actor also claims to have a proof-of-concept video and says pricing is available through private communication.
However, the listing does not name a CVE, identify exact affected firmware builds, explain whether authentication is required, or provide a technical description of the alleged vulnerability.
These omissions make it impossible to determine whether the claimed exploit targets an undisclosed flaw, an older patched vulnerability, a bypass of an existing fix, or a fraudulent product.
Cisco Warns of Critical ISE 0-Day Vulnerability
Cisco has sent an urgent warning about a serious security hole in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). This problem, known as CVE-2026-76460, is already being used in attacks, according to Cisco’s Product Security Response Team.
The flaw has a highest CVSS score of 10.0. It might let a remote attacker without login access get around security on the affected systems.
Administrators should check systems for signs of exploitation. Cisco suggested looking at the access.log file for unusual usernames or unexpected API activity.
Security teams need to gather support bundles that have debug logs on to see extra API gateway logs. Cisco said that proof on a hacked device might not be complete since attackers with full access can delete or hide important evidence.
Organizations should check firewall and network logs that are not from the affected device. Unusual uploads from an ISE node to outside IP addresses, strange downloads, and unknown outbound connections might mean there is a security breach.
