Patching still a huge problem - 150k unpatched Fortinet devices on 1 month old critical flaw

Recent web scans have detected that approximately 150,000 systems utilizing Fortinet's FortiOS and FortiProxy secure web gateway are still exposed to a critical vulnerability tracked as CVE-2024-21762. The vulnerability, with a critical severity score of 9.8 has been reported and patched more tha a month ago.

Despite Fortinet's efforts to address the vulnerability, The Shadowserver Foundation reported finding nearly 150,000 devices still at risk. Shadowserver notest that some other mitigating measure may be in place for some systems. But the number of vulnarable systems is still in the tens of thousands.

The distribution of vulnerable devices is global, with the  United States over 24,000, followed by India, Brazil, and Canada.

Unfortunately, patching is a significant overhead that nobody wants to take up: It's tedious and requires masive effort - especially in distributed networks, it's risky, most of it can't be done during the work day, is subject to constant postponing because of business priorities and finally, companies are suffering from too much optimism.

Yet patching discipline together with MFA enforcement are the two best controls to most cybersecurity risks. Embrace the suck, and patch.