After Fortinet patched a major FortiOS bug on June 12, researchers find that ~336K out of ~490K affected SSL VPN interfaces are still unpatched and open to RCE
many used by government organizations — aren't patched to deal with a critical bug identified last month https://therecord.media/...
Context & Ripple Effects
This is the third time Fortinet's edge has made the exploited-vulnerability cycle in recent years: after the 2022 remote authentication bypass in FortiOS, FortiProxy, and FortiSwitchManager, and the 2019 wave of attacks hitting enterprise VPN services from Pulse Secure and Fortinet, the company patched a major FortiOS bug on June 12. The new finding is that a month later, roughly 336K of ~490K exposed SSL VPN interfaces — many run by government organizations — still haven't applied it.
The unpatched-after-patch pattern is not Fortinet-specific: the same gap showed up in 2016 when a scan found 840K+ Cisco devices exposed via an NSA-linked flaw despite available fixes, and in 2020 when hackers remotely exploited F5's BIG-IP bug after a patch was published. What distinguishes this instance is the concentration in government-facing SSL VPN endpoints, the single most valuable entry point into a network.
First-order effects
- The ~336K unpatched interfaces — disproportionately government organizations — remain directly exploitable for remote code execution despite a working patch being available since June 12, making Fortinet's customer base the immediate exposure surface.
- Fortinet now faces the same remediation-trust problem it had in 2016, when researchers found its firewall software allowed remote access via a hard-coded password: repeated critical edge flaws put its government and enterprise accounts on the defensive.
Second-order effects
- Attackers can simply scan for the residual ~336K interfaces, repeating the playbook from the 2019 Webmin/Pulse Secure/Fortinet VPN attack wave where publicized flaws were weaponized within days — the patch gap converts disclosure into a target list.
- Rivals and procurement teams gain ammunition: with Fortinet holding a 7.0% share of the global cybersecurity market in Q1 2023 and deepening its Intel partnership, buyers weighing edge vendors now have a documented remediation-lag data point against the incumbent.
Third-order effects
- If the pattern holds — Cisco's 840K unpatched devices in 2016, Citrix's 80K+ exposed businesses in 2019, Fortinet's ~336K now — the persistent patch gap at the network edge points toward regulators treating SSL VPN appliances as critical infrastructure with mandated remediation timelines rather than voluntary patching.
- The structural shift is from vendor-by-vendor incident response to ecosystem-level defense: government reliance on a handful of edge-appliance vendors concentrates systemic risk, so the fix pressure moves from individual admins to sector-wide patch enforcement and shared exposure monitoring.
The trend: Network-edge VPN appliances keep repeating the same cycle — critical flaw, prompt patch, slow adoption — and the accumulating unpatched population is pushing edge devices toward regulated critical-infrastructure treatment.