Alerts and Advisories

Fortinet is aware of reports of malicious cyber actors targeting Fortinet devices in a credential-harvesting campaign referred to as FortiBleed. Based on our initial analysis, we believe the activity involves threat actors reusing credentials from previous incidents (FG-IR-26-060, FG-IR-25-647) and employing brute-force techniques (as described in a March blog, “Attacks at the Speed of AI”) against devices with weak password hygiene and no multi-factor authentication (MFA).

The Fiji CERT with the Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) has observed ClickFix associated activity leveraging WordPress hosted infrastructure to distribute the Vidar Stealer malware. This activity is targeting Australian infrastructure and organisations across multiple sectors. The campaign uses compromised WordPress websites to redirect victims to malware delivery mechanisms. This advisory provides an overview of the activity, an assessment of the threat, observed indicators, detections and recommended mitigations.

This alert is relevant to all Fijian organisations that utilise cPanel/ WebHost Manager (WHM). This alert is intended for a technical audience. Fiji CERT is aware of active exploitation in the region of a critical vulnerability (CVE-2026-41940) affecting cPanel/WHM products. The vulnerability is an authentication bypass, which can allow unauthenticated remote attackers to gain access to the control panel, as well as conduct remote code execution (RCE). The vulnerability affects all versions after 11.40 (which was released in 2013). Patches have been released as of 30 April 2026. Fiji CERT does not have information to indicate that a specific industry or sector is being targeted, however it is noted that products managed by several Managed Service Providers have been impacted, resulting in the compromise of their customers.

All Critical Infrastructure operators, Government agencies, and private sector organisations to strengthen monitoring and defensive measures against covert networks of compromised devices linked to advanced China-nexus threat actors.

A flaw in Cisco Catalyst SD-WAN Manager’s API authentication could let a remote attacker gain **netadmin-level access** by sending crafted requests, potentially allowing full control of the system.

An authorized user can exploit improper access control in SQL Server to gain elevated privileges over the network.