How to Reduce Risk Without Ripping and Replacing
Fortinet appliances are widely deployed in enterprises for VPN and firewall protection—but they’ve also become a prime target for attackers. Recently, reports have surfaced that threat actors are actively selling FortiGate zero-day exploits on underground forums, claiming full remote access capabilities across a broad range of Fortinet devices.
These types of vulnerabilities aren’t just theoretical—they’ve been exploited before, and they’re happening again. Organizations relying on Fortinet should take this threat seriously and explore immediate ways to reduce their exposure—without disrupting users or undertaking major infrastructure changes.
The Challenge with Fortinet Zero-Days
Fortinet has a growing list of critical CVEs, many of which target the VPN and firewall components of its stack. These vulnerabilities often:
- Bypass authentication completely
- Provide remote code execution
- Target unpatched or misconfigured systems still widely in use
- Allow attackers to persist silently in the network
For security teams, that means more patching cycles, more emergency mitigations, and a constant race against threat actors moving faster than official updates.
But patching alone isn't enough. When zero-day exploits are sold before Fortinet even releases a fix, companies need an added layer of defense that doesn’t rely on waiting for the next firmware update.
Reducing exposure right now can be achieved in a few different ways.
- Reduce your exposure but add a lot of complexity and possibly frustrate your users
- Rip and replace with a ZTNA offering with all the risks and headaches associated
- Migrate to a ZTNA client that locks down the gateways and slowly move to a full high-performance ZTNA
The risks and challenges of point two are already well understood, so let’s begin by addressing point three before circling back to point one.
Migrate - You Don’t Need to Rip and Replace
Many IT teams hesitate to move away from Fortinet entirely due to the complexity and investment involved. The good news: you don’t have to.
There are ways to secure your existing Fortinet infrastructure, lock down vulnerable services, and eliminate public exposure—all without removing the device or breaking access for your users.
Migrate to a ZTNA - Next Steps
If you’re using Fortinet for VPN access, take this opportunity to reassess how that access is delivered. Look for solutions that:
- Create a Cloudbassed invisible IPsec proxy dark network connector
- Migrate end user VPN clients to a High-Performance ZTNA app
- Remove public-facing gateway exposure
- Lock Down access to the non-public, unpublished dark networks connectors
- Enforce identity-based authentication
- Support ephemeral, role-based access
- Remove your reliance on patch timing and vendor alerts for external zero-day attacks
Your security posture shouldn’t depend on hoping the next patch arrives before the next exploit is sold.
Would you like help securing your Fortinet deployment without starting from scratch? Let’s talk.
How to Reduce Exposure Right Now
Here are practical steps you can take to reduce your Fortinet risk footprint—without waiting on vendors or embarking on massive rearchitecting projects:
1. Limit Public Exposure of VPN Gateways
The most exploited surface is often the public IP address of the Fortinet VPN itself. If attackers can’t reach it, they can’t exploit it. Use firewall rules or upstream network controls to limit VPN access to trusted IPs. (This is time consuming and complex if you have mobile users)
2. Replace Always-On VPNs with Temporary, Identity-Bound Access
Traditional VPNs maintain long-lived sessions and credentials, often making lateral movement easy after compromise. Consider shifting to a Zero Trust model that enforces short-lived, identity-based connections.
3. Segment Network Access by Role and Location
Enforce role-based access controls and network segmentation to ensure users only reach the resources they truly need. This reduces the blast radius even if an account or session is compromised.
4. Monitor for Early Signs of Exploitation
Use behavioral monitoring, anomaly detection, and session logging to catch signs of suspicious activity tied to Fortinet services—especially unexpected logins, configuration changes, or lateral movement.
Your security posture shouldn’t depend on hoping the next patch arrives before the next exploit is sold.
Do you need assistance enhancing the security of your Fortinet deployment without rebuilding it from the ground up? Let’s talk.
