Your Firewall May Patch Itself. Ransomware Still Gets In.

Boris Szelcsanyi · 24 October 2026

When we show a company that its firewall matches a ransomware entry point, the first answer is often: “but the firewall updates itself.” It is a fair point, and for some firewalls it is now partly true. Since FortiOS 7.4.5, a FortiGate installs new patch releases on its own by default. But “the firewall updates itself” and “the firewall is safe” are two different statements, and the gap between them is where most firewall-led ransomware attacks happen.

This post explains what really updates automatically on Fortinet and Palo Alto firewalls, why so many devices still lag behind, and why even a fully patched firewall can still let an attacker in. Every figure is linked to its source.

What updates automatically, and what doesn’t

A firewall gets two kinds of updates. Security content (threat signatures, antivirus, application and URL lists) refreshes on a schedule. On Palo Alto firewalls that can be as often as every 30 minutes. Fixes to the firewall’s own operating system are firmware upgrades, and those are what close the holes attackers use to get in.

• Palo Alto (PAN-OS): there is no automatic operating-system upgrade. An admin schedules each PAN-OS upgrade as a one-time job, to a version they choose (Palo Alto docs).
• Fortinet (FortiOS): automatic patch upgrades came with FortiOS 7.2.6 for small desktop models. Since FortiOS 7.4.5 and 7.6.1 they are on by default for every FortiGate model, including virtual ones. The firewall waits three days after a release, then installs it at a random time between 02:00 and 04:00 (7.4.5 release notes, admin guide).

That sounds like the problem is solved. It isn’t, for four reasons Fortinet’s own documentation gives:

• It only patches within a branch. A firewall on 7.2.x only moves to a newer 7.2.x, never to 7.4. When the branch reaches end of support, the automatic patches stop. FortiOS 7.2 reached end of support on 30 September 2026 (endoflife.date).
• It can’t be switched on for managed fleets. Automatic upgrades cannot be enabled on FortiGates managed by FortiManager or in a Security Fabric (admin guide). That is how many MSPs run their clients’ firewalls, so the MSP’s patch process is what counts.
• Older firmware doesn’t have the feature on. A firewall that has not been upgraded to 7.4.5 or later since it was installed never got the new default.
• A lapsed support contract blocks the download. Since 7.4.8, FortiGates without a valid firmware licence are pushed to upgrade, but Fortinet notes the upgrade “may fail where the firmware download is blocked” (Fortinet).

Why so many firewalls still lag behind

Every operating-system upgrade ends with a reboot. Fortinet tells admins to “schedule a maintenance window”, and Palo Alto says plainly that “a reboot is required”. A company with a pair of firewalls in high availability upgrades one at a time and stays online (Fortinet, Palo Alto). A mid-sized company with a single firewall loses internet and VPN until it comes back, so upgrades get pushed to “the next window”.

Hardware ages out too. Palo Alto supports a firewall for five years after it stops being sold, and only up to its last supported PAN-OS version (Palo Alto). After that, new fixes don’t reach it.

The result shows up in internet-wide counts:

• About five weeks after Fortinet fixed the SSL-VPN flaw CVE-2024-21762, the Shadowserver Foundation still counted nearly 150,000 potentially vulnerable FortiGates (Security Affairs).
• A Fortinet two-factor bypass fixed in 2020 (CVE-2020-12812) still had more than 10,000 unpatched FortiGates in January 2026 (SDxCentral).
• Verizon’s 2026 breach report found that only 26% of known exploited vulnerabilities were fully fixed during the year, after a median of 43 days (Verizon DBIR 2026).

These counts come from version scans, so they mean “potentially vulnerable”, not confirmed compromised. They still show that “someone will patch it” often doesn’t happen.

Attackers often arrive before the patch

Even a firewall that patches itself within three days can be too late:

• Palo Alto CVE-2024-3400: attackers were exploiting it from 26 March 2024. Palo Alto’s advisory came on 12 April, and the first fixes on 14 April (Volexity, Palo Alto).
• Fortinet CVE-2024-21762: Fortinet’s advisory of 8 February 2024 already said it was “potentially being exploited in the wild”, and CISA listed it as exploited the next day (Fortinet).
• Fortinet CVE-2024-55591: exploited from November 2024, about eight weeks before Fortinet’s advisory in January 2025 (Arctic Wolf).

This is no longer rare. Mandiant measured the average time from disclosure to exploitation at 5 days in 2023 (Mandiant). VulnCheck found that 32% of the vulnerabilities added to CISA’s known-exploited list in the first half of 2025 were exploited on or before the day they were published (VulnCheck).

Patching doesn’t remove an attacker who is already in

This is the part most owners don’t expect. A patch closes the door. It does not throw out whoever already came through it.

• The Fortinet backdoor that survived patching. In April 2025 Fortinet disclosed that attackers who had broken in through three older SSL-VPN flaws had left a hidden link on the device. The link kept read-only access to the firewall’s files, including its configuration, after the device was patched. Fortinet told affected customers to “treat all configuration as potentially compromised” (Fortinet). France’s CERT-FR reported a large campaign in France going back to early 2023 (CERT-FR). Shadowserver counted 16,620 affected devices, 3,766 of them in Europe (The Hacker News).
• Then the clean-up was bypassed. In February 2026 Fortinet fixed a way around its own removal of that link (CVE-2025-68686), with fixes only for the 7.4 and 7.6 branches. CISA listed it as exploited on 27 July 2026 (Fortinet).
• Other vendors say the same. Palo Alto published an “enhanced factory reset” after CVE-2024-3400. Cisco said its 2025 firewall attackers’ foothold “is preserved across upgrading to the fixed releases” (Cisco).
• Stolen logins outlive the patch. In 2025 Germany’s BSI warned that the Akira ransomware group broke into SonicWall firewalls that were on current firmware with MFA enabled, because local passwords had not been changed after a migration (BSI).

Ransomware groups use exactly this

US authorities list firewall flaws and VPNs without MFA as standard entry points for several large ransomware groups: Akira (AA24-109A), Play (AA23-352A) and RansomHub (AA24-242A). In 2026, Qilin got in through new VPN flaws in Check Point and Palo Alto firewalls (Arctic Wolf). Sophos’s 2026 survey of ransomware victims found that when the firewall was the way in, 59% of ransom demands were $1 million or more (Sophos).

We also counted it ourselves. In CISA’s Known Exploited Vulnerabilities catalogue (version of 23 October 2026), 12 firewall and VPN vendors account for 276 entries, and 70 of them are flagged as used in ransomware campaigns. That is 19% of all ransomware-linked entries.

Counts per vendor across all of its products (Cisco’s include routers, for example), from the CISA KEV feed.

What to do if you run a FortiGate or Palo Alto firewall

1. Check that automatic patching is on (FortiGate: System > Firmware & Registration), and which branch you are on. If it is 7.2 or older, plan the move to a supported branch.
2. If an MSP manages the firewall, ask how fast they patch after a critical advisory. On managed FortiGates the automatic feature isn’t available.
3. Check the support contract. Without it, the firewall may not get the firmware at all.
4. After any critical firewall advisory, patch and then reset: VPN and admin passwords, MFA enrolments, and a review of the configuration. CERT-FR and Fortinet both advise this.
5. Make sure every VPN login needs MFA. A VPN without MFA is the entry point CISA names most often for Akira.
6. Plan reboots instead of avoiding them: a fixed monthly window, or a second firewall in high availability if downtime is the real blocker.

How Nisura handles this

Our external scan finds the firewalls and VPN logins a company exposes to the internet, matches them to vulnerabilities that CISA lists as exploited, and ranks them with CISA’s own decision method. From the outside we usually see the product, not the exact firmware version. In that case we say “verify”, not “vulnerable”: check the version on the device first, then act. When the version is confirmed and the flaw is on CISA’s list, we say “act”. And because a patched firewall can still leak stolen VPN logins, our loss model counts the credential and VPN path separately from vulnerabilities, so “we patched” never drops that risk to zero.

Sources

• Fortinet: FortiOS automatic firmware upgrade, FG-IR-24-015, symlink persistence analysis, FG-IR-25-934
• Palo Alto Networks: scheduled software updates, CVE-2024-3400 advisory, end-of-life policy
• CISA: Known Exploited Vulnerabilities catalogue; #StopRansomware advisories AA24-109A, AA23-352A, AA24-242A
• BSI: Cybersicherheitswarnung 2025-271036-1032; CERT-FR: CERTFR-2025-ALE-004
• Verizon: 2026 Data Breach Investigations Report; Sophos: State of Ransomware 2026
• Mandiant: time-to-exploit trends; VulnCheck: state of exploitation 1H 2025; Volexity: CVE-2024-3400