FortiManager
Fortinet's central management platform for FortiGate firewalls.
When Check Point management servers came under attack in September 2026, the precedent was FortiManager's 2024 breach, in which attackers took FortiGate configurations from more than 50 potentially compromised management servers.
Last refreshed: 12 October 2026
What did attackers take from FortiManager in the 2024 breach?
Timeline for FortiManager
Mentioned in: Two 9.8 Check Point flaws hit firewalls
Cybersecurity: Threats and DefencesBackground
FortiManager is Fortinet's platform for running fleets of FortiGate firewalls from one server. Each FortiManager holds the settings for every firewall it controls, so a breach of the console exposes the whole fleet.
Fortinet published advisory FG-IR-24-423 on 23 October 2024 for CVE-2024-47575, a missing-authentication flaw in the fgfmd daemon, scored 9.8, that let a remote attacker run code. Fortinet had warned customers privately before going public. Mandiant traced exploitation by a cluster it calls UNC5820 back to 27 June 2024 and found more than 50 potentially compromised FortiManager devices. The intruders copied the configuration of the FortiGate devices each server managed, user accounts and hashed passwords included.
That breach is the reference case for attacks on security management servers, and it was cited again when Check Point's management servers were hit in September 2026.