Fortinet’s FortiGate firewalls are used across businesses of every size, from small offices to major enterprises. That widespread use is exactly what makes them such an attractive target, and the last several months have shown why staying ahead of that target painting is a full-time job in itself.
What has been happening with FortiGate
Between December 2025 and early 2026, Fortinet disclosed a string of serious vulnerabilities affecting FortiGate devices and related products. Two of them allowed attackers to bypass login authentication entirely using a crafted message, no valid password required, and were added to the federal government’s list of vulnerabilities known to be under active attack. A third, discovered in January 2026, let attackers log into fully patched FortiGate devices through a flaw in Fortinet’s own cloud single sign-on system, allowing them to create unauthorized administrator accounts and rewrite firewall rules from the inside.
On top of that, a separate large-scale campaign uncovered tens of thousands of exposed FortiGate devices where attackers had cracked stored credentials, many of them left as default or generic administrator accounts that were never renamed after installation.
The pattern worth paying attention to
None of this means FortiGate hardware is uniquely flawed. It means that even a fully patched, well-known firewall brand can be exposed by a vulnerability nobody knew existed yet, and that the businesses most protected were the ones with someone actively watching for these advisories, applying emergency patches within days, and checking for unauthorized changes after the fact.
That is a demanding, ongoing job. For a business without a dedicated security team, it is often the job that quietly does not get done, not out of neglect, but because nobody was assigned to do it.
How a managed model changes this equation
This is the real difference between owning a firewall and being protected by one. CONNECT is built so that emergency patches, configuration monitoring, and unusual account activity are watched for you as part of the service, rather than depending on someone at your business catching a security advisory in time.
A side-by-side look
| Typical Self-Maintained FortiGate | CONNECT | |
|---|---|---|
| Emergency patching | Depends on someone monitoring advisories | Handled as part of the managed service |
| Unauthorized admin accounts | Often discovered after the fact | Activity and access monitored continuously |
| Default credentials | Frequently never rotated | Unique credentials set during onboarding |
| Support when something looks wrong | Vendor support ticket | Direct notification and guidance |
The honest takeaway
Any firewall brand can be affected by a zero-day vulnerability. That is simply the nature of security software. The real question for a small or medium business is not “which brand never has a flaw,” because that brand does not exist. The real question is who is watching for the flaw and fixing it fast, and whether that responsibility sits with you or with the service protecting your network.
If you want to see how a managed model handles this differently, visit our business page.
See How CONNECT Protects Your Business →