SSL VPN portals are the most photographed part of a FortiGate estate. They have certificates, login pages, and a habit of answering on both 443 and the administrative port. That makes them easy to count from the outside, and tempting to treat as an exposure metric. The CL-STA-0954 intrusion shows why the count and the risk are different numbers.

Unit 42's 14 October 2026 write-up describes a September 2024 intrusion against a telecommunications managed service provider. The attackers exploited CVE-2024-47575 in FortiManager, exfiltrated configuration archives for more than 500 FortiGate firewalls, and then used the stolen material to open unauthorized SSL VPN sessions to perimeter firewalls. Credentials travelled with the archive. No VPN vulnerability was needed for that step; the sessions were established with legitimate-looking credentials that happened to belong to someone else.

ZoomEye measurements for this article, taken 2026-10-22, put the population in perspective. app="FortiGate SSL VPN" returned 2,685,225 matching assets. Restricting to the HTTPS portal gave 574,131 for app="FortiGate SSL VPN" && port="443" and 1,181,307 for app="FortiGate SSL VPN" && port="10443". The narrower fingerprint app="FortiGate" && port="10443" returned 47,893.

What the counts do and do not say

The 2.7 million figure counts assets that carry the FortiGate SSL VPN fingerprint. It does not say which of them run FortiOS builds affected by CVE-2025-61624, which is a path traversal in the command line interpreter affecting FortiOS 7.4.0 through 7.4.9 and 7.6.0 through 7.6.4 among others. It does not say which are managed by a FortiManager that accepted a rogue device registration. And it certainly does not say which have had a session opened with stolen credentials.

What the counts do say is that this is a large, homogeneous, well-fingerprinted population. Homogeneity helps defenders. A single detection rule, a single configuration baseline, and a single patch cadence can cover most of it, if you know where your own devices sit in the population.

Two ports, one decision

The split between 443 and 10443 is useful. Port 10443 is the common administrative HTTPS port on these devices. When the portal answers there, it usually means remote administration is reachable, not only VPN authentication. The 47,893 assets matching app="FortiGate" && port="10443" are a narrower set that includes appliances with a management surface on that port.

Reviewing this is a short exercise. Pull the certificate subjects and SANs for your own portals, compare them to the inventory, and confirm which hostname answers on which port. Then confirm whether the administrative interface on that port is restricted by trusted-host policy or reachable from the general internet. Unit 42 describes the attackers setting up unauthorized SSL VPN sessions to perimeter firewalls; a management interface exposed to the same internet is the next logical step for anyone working from a stolen configuration.

Version visibility remains the gap

External measurement gives you product identity and port. It does not give you firmware build. That gap is where most patching programmes lose time, because an asset list without versions cannot be triaged against CVE-2025-61624 ranges or the earlier FortiManager ranges in CVE-2024-47575.

Close it internally. Export the firmware version for each enrolled FortiGate from the management platform, join it to the external view by public IP and certificate, and mark every asset where the two disagree. Disagreement usually means an enrolled device that nobody has patched, or an internet-facing appliance that is not enrolled at all.

Practical next steps

  • Enumerate FortiGate SSL VPN portals by certificate rather than by DNS name, so that forgotten hostnames appear.

  • Confirm that administrative access on 10443 is limited by trusted hosts and that the portal on 443 does not share a credential store with it.

  • Rotate VPN credentials and certificates for any device whose configuration could have been in a stolen archive; treat the rotation as a separate project with its own deadline.

  • Require multi-factor authentication on every SSL VPN portal, including portals used only by contractors.

  • Reconcile the internal firmware list against NVD ranges quarterly, not on the day an advisory is published.

Limits

None of the measurements above identify a compromised device, and the campaign described by Unit 42 involved one managed service provider, not the global FortiGate population. The numbers are a denominator. They tell you how much of the internet shares your product family, which is useful for scoping a review and useless as evidence of intrusion.

References

  • Unit 42, "Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant", 14 October 2026: https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/

  • NVD, CVE-2024-47575: https://nvd.nist.gov/vuln/detail/CVE-2024-47575

  • NVD, CVE-2025-61624: https://nvd.nist.gov/vuln/detail/CVE-2025-61624

  • Fortinet PSIRT, FG-IR-26-122: https://fortiguard.fortinet.com/psirt/FG-IR-26-122