A recent campaign exploited a critical zero-day vulnerability in Fortinet FortiOS and FortiProxy products allowing attackers to gain administrator privileges through crafted requests to the “Node.js” websocket module. The flaw, tracked as CVE-2024-55591, has been actively exploited since at least November 2024 and affects FortiOS versions 7.0.0-7.0.16 as well as FortiProxy versions 7.0.0-7.0.19 and 7.2.0-7.2.12. Cybersecurity firm Arctic Wolf identified attacks targeting FortiGate firewall devices with exposed management interfaces, involving unauthorized logins, account creation, SSL VPN tunneling, and credential extraction via DCSync for lateral movement. The campaign progressed through distinct phases, including reconnaissance and configuration changes, and appeared opportunistic rather than sector-specific. Fortinet has since released patches and indicators of compromise (IoCs) to help defenders detect and mitigate attacks. Alongside CVE-2024-55591, Fortinet addressed thirteen (13) other high-severity vulnerabilities across its products, emphasizing the importance of prioritizing prompt patching to prevent exploitation. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, mandating that all Federal Civilian Executive Branch Agencies patch the flaw by no later than January 21, 2025. CTIX analysts recommend any organizations implementing vulnerable infrastructure restrict access to firewall management interfaces, monitor for unusual activity, and apply all updates to secure their systems.