Fortinet exploit adds 13 payloads for account creation and persistence
In February 2026, CrowdStrike found a modified proof of concept for an authentication-bypass flaw in FortiOS and FortiProxy in an open directory controlled by Iran-nexus group STATIC KITTEN. The code had 13 hardcoded payloads, compared with one user-supplied command in the public version of CVE-2024-55591.
The added commands are designed to enumerate targets, create users, and establish persistence, making the proof of concept a more complete tool than a one-off demonstration. But finding the code in the directory does not show that it was deployed: CrowdStrike has not confirmed its use in an intrusion or observed other actors using it. Whether STATIC KITTEN modified the code or obtained it elsewhere is also unknown.
For organizations running the affected FortiOS or FortiProxy versions, closing the vulnerability would not establish whether accounts or persistence had already been left behind. CrowdStrike reported no confirmed victim activity, so the tool's presence should not be read as proof of compromise.
CVSS 9.8 CRITICAL: an Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0… Known ransomware campaign use. EPSS 94% (100th percentile).
CISA federal remediation date Jan 21 · date passed
Adversaries Turn the Vulnerability Ecosystem Against Defenders
CrowdStrike’s analysis of vulnerability weaponization timelines reveals adversaries are quickly adopting public vulnerability research, often within hours.