According to heise online, the US security agency CISA is warning of ongoing attacks on security vulnerabilities in Fortinet products and in BeyondTrust Remote Support. The flaws are reportedly already being exploited in the wild and are not just a theoretical risk. The short report gives no further details, such as which versions are affected.

Why such warnings should be taken seriously

Fortinet products are often used in companies at central points of the network, for example as a firewall or as an entry point for remote access. BeyondTrust Remote Support is remote maintenance software: support teams use it to control computers and servers from a distance.

Both types of product have far-reaching privileges and are often reachable from the internet. That makes them attractive to attackers. If an attacker manages to exploit a flaw, it can be a way into the internal network. Whether that happens in a given case, and how far it goes, depends on the specific vulnerability and the configuration.

When an agency like CISA warns of active attacks, it is a signal to act quickly. It is then no longer enough to schedule updates for the normal maintenance window.

What administrators can check

The following steps are general recommendations and do not replace the vendors' guidance:

  • Take inventory: Which Fortinet devices and which BeyondTrust installations are in use, and at which version?
  • Read the vendor advisories: The vendors' security advisories and CISA's notices name the affected versions and the matching updates.
  • Prioritize updates: Available patches for systems reachable from the internet should be applied first.
  • Restrict access: Management interfaces and remote maintenance tools should be reachable only from the addresses that need them. If a patch cannot be applied immediately, the interim measures named by the vendor can help.
  • Review logs: Unusual logins, new accounts or unexpected connections can indicate an attack that has already taken place.

The last point is easy to forget. An update closes the vulnerability, but it does not automatically remove an access path that attackers created earlier.

Assessment

The heise online report is brief. Anyone running the affected products should therefore consult the original sources from the vendors and CISA to determine whether their own systems are affected.