Fortinet Alerts of 2FA Bypass in FortiOS VPN, CISA Warns on Digiever NVR Vulnerability – Thursday, December 25, 2025

Fortinet has issued a warning about the active exploitation of a vulnerability in its FortiOS SSL VPN that allows attackers to bypass two-factor authentication (2FA). Concurrently, the Cybersecurity and Infrastructure Security Agency (CISA) has flagged a critical remote code execution vulnerability in Digiever NVR systems, urging organizations to apply patches immediately to mitigate these escalating risks.

Who should care: CISOs, SOC leads, threat intelligence analysts, fraud & risk leaders, identity & access management teams, and security operations teams.

What happened?

Fortinet has confirmed that a vulnerability in its FortiOS SSL VPN is being actively exploited by attackers to bypass two-factor authentication, a key security control designed to prevent unauthorized access. This flaw enables threat actors to circumvent 2FA protections and gain unauthorized entry into networks that rely on Fortinet’s VPN solutions. Given the critical role of 2FA in safeguarding sensitive data and systems, this vulnerability represents a significant security risk for organizations worldwide. At the same time, CISA has issued an alert regarding a separate but equally serious vulnerability in Digiever Network Video Recorder (NVR) systems. This flaw allows remote code execution, meaning attackers can run arbitrary commands on affected devices without authorization. Such capabilities can lead to full system compromise, data theft, or disruption of surveillance infrastructure, which is particularly concerning for organizations relying on these systems for security monitoring. Both Fortinet and Digiever have released patches to address these vulnerabilities. However, the urgency to apply these updates cannot be overstated, as active exploitation attempts are ongoing across multiple sectors. Attackers are rapidly targeting these weaknesses, making it imperative for organizations to prioritize remediation efforts to prevent potential breaches and system takeovers.

Why now?

These alerts come at a time when cybercriminals are increasingly focused on exploiting known vulnerabilities in widely deployed network infrastructure. Over the past 6 to 18 months, there has been a notable rise in both the sophistication and frequency of attacks targeting VPNs and network devices. The surge in remote work has expanded the attack surface, making VPNs and related systems prime targets. The current focus on Fortinet and Digiever vulnerabilities reflects a broader trend of adversaries targeting critical network components that serve as gateways to corporate environments, underscoring the necessity for continuous vigilance and timely patching.

So what?

The active exploitation of these vulnerabilities highlights the critical importance of robust patch management and continuous vulnerability assessments. Failure to address these issues promptly could result in unauthorized access, data breaches, and operational disruptions. Security teams must act swiftly to mitigate these risks by applying patches, enhancing monitoring, and validating authentication mechanisms. From a strategic perspective, this situation reinforces the need for comprehensive incident response plans and layered security controls to defend against evolving threats.

What this means for you:

• For CISOs: Confirm that all relevant patches are deployed promptly and review your organization’s vulnerability management and patching workflows to ensure they are effective.
• For SOC leads: Intensify monitoring of network traffic for indicators of compromise related to these vulnerabilities and update detection rules accordingly.
• For identity & access management teams: Reassess the integrity of 2FA implementations and consider deploying additional authentication layers where feasible to strengthen defenses.

Quick Hits

• Impact / Risk: Active exploitation could lead to significant data breaches and unauthorized access to critical systems.
• Operational Implication: Organizations risk increased regulatory scrutiny and financial losses if vulnerabilities remain unpatched.
• Action This Week: Immediately review all Fortinet and Digiever systems to ensure patches are applied, and brief executive leadership on associated risks and mitigation strategies.