InfoSecBulletin Cybersecurity for mankind
A threat actor is allegedly offering a private remote code execution exploit for Fortinet FortiGate SSL VPN appliances, claiming that FortiOS 7.2.x and 7.4.x are affected. The listing has not been independently verified and does not confirm the existence of a new FortiGate zero-day vulnerability.
The ad by Dark Web Intelligence talks about a “1-day” exploit that lets someone run code from far away.
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
The exploit is reportedly intended for initial access against exposed FortiGate SSL VPN services. The actor also claims to have a proof-of-concept video and says pricing is available through private communication.
However, the listing does not name a CVE, identify exact affected firmware builds, explain whether authentication is required, or provide a technical description of the alleged vulnerability.
These omissions make it impossible to determine whether the claimed exploit targets an undisclosed flaw, an older patched vulnerability, a bypass of an existing fix, or a fraudulent product.
Cisco Warns of Critical ISE 0-Day Vulnerability
Cisco has sent an urgent warning about a serious security hole in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). This problem, known as CVE-2026-76460, is already being used in attacks, according to Cisco’s Product Security Response Team.
The flaw has a highest CVSS score of 10.0. It might let a remote attacker without login access get around security on the affected systems.
Administrators should check systems for signs of exploitation. Cisco suggested looking at the access.log file for unusual usernames or unexpected API activity.
Security teams need to gather support bundles that have debug logs on to see extra API gateway logs. Cisco said that proof on a hacked device might not be complete since attackers with full access can delete or hide important evidence.
Organizations should check firewall and network logs that are not from the affected device. Unusual uploads from an ISE node to outside IP addresses, strange downloads, and unknown outbound connections might mean there is a security breach.
