Fortinet has issued an urgent warning about a post-exploitation persistence technique that allows threat actors to retain read-only access to FortiGate VPN devices even after the vulnerabilities used in the original compromise (such as CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762) have been patched. The attackers exploited these flaws to create symbolic links (symlinks) in the language file directories used by the SSL-VPN interface, linking the user file system to the root file system. This modification, which occurs in the user-accessible portion of the system, allows continued access via the public SSL-VPN panel and can persist through software updates without detection. Devices with SSL-VPN disabled are not affected. Fortinet, the French national Computer Emergency Response Team (CERT-FR), and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) report that this technique has been used since early 2023 in widespread campaigns, including against critical infrastructure. To address the issue, Fortinet released updates (FortiOS 7.6.2, 7.4.7, 7.2.11, 7.0.17, 6.4.16) that remove the symlinks and prevent such abuse through antivirus detection and SSL-VPN UI changes. Administrators are urged to upgrade immediately, audit device configurations, remediate potentially exposed credentials, and consider temporarily disabling SSL-VPN. Experts warn this incident highlights the growing trend of attackers using rapid post-exploitation backdoors designed to survive patching, upgrades, and even factory resets.