Fortinet FortiOS CVE-2025-53844

Apply Fortinet's security patches immediately per advisory FG-IR-26-123 at https://fortiguard.fortinet.com/psirt/FG-IR-26-123. The advisory should specify fixed versions for each affected branch (typically 7.2.12+, 7.4.9+, 7.6.4+, though exact versions must be confirmed from Fortinet's advisory as patch version data was not provided in source intelligence). Until patching is complete, implement these compensating controls with noted trade-offs: (1) Restrict management interface access to trusted internal IP ranges only via firewall rules - reduces attack surface but complicates remote administration, requiring jump hosts or VPN; (2) Enforce multi-factor authentication for all FortiOS administrative accounts - raises attacker cost for credential theft but doesn't prevent exploitation if credentials are compromised via session hijacking; (3) Monitor for anomalous authenticated sessions with unusual packet patterns or memory consumption spikes - provides detection capability but requires SIEM integration and tuning to reduce false positives. Organizations unable to patch immediately should prioritize controls (1) and (2) as defense-in-depth, recognizing these mitigations delay but do not eliminate exploitation risk.