Fortinet initially identified and issued a patch for a critical vulnerability (CVE-2023-27997) in its FortiOS and FortiProxy SSL-VPN software in June. However, almost a month later, nearly 70% of the affected firewall devices haven’t been patched yet, according to Bishop Fox’s recent study.

This heap-based buffer overflow vulnerability in its operating system behind FortiGate firewalls and secure socket layer-VPN — with a severity score of 9.8 out of 10 — may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests, according to Fortinet’s advisory.

It also noted the investigation team found the vulnerability “may have been exploited in a limited number of cases.”

The security vendor published the initial Security Incident Response Team (PSIRT) advisory on June 12 that recommends customers who have SSL-VPN enabled to take immediate action to upgrade to the most recent firmware release.

Despite the patch release and Fortinet’s advisories, security consulting firm Bishop Fox found only 153,414 devices on the internet have been patched out of nearly 490,000 exposed SSL-VPN interfaces, which means around 69% of Fortinet firewalls are unpatched.

Bishop Fox’s capability development team built an exploit for the vulnerability and conducted a Shodan search to determine these numbers.

Researchers also discovered there are “a handful of devices running 8-year-old FortiOS on the internet.”

“You should patch yours now,” the vendor wrote in a blog post. “We want to see our customers keep their most important assets patched in a timely manner, especially those with vulnerabilities that are proven to be exploitable.”

Responding to the discovery, Fortinet told SDxCentral that it offered details and clarifications to help customers make informed, risk-based decisions. “Fortinet continues to monitor the situation and has been proactively communicating to customers, strongly urging them to immediately follow the guidance provided to mitigate the vulnerability using either the provided workarounds or by upgrading,” the vendor wrote in a statement.

Security experts noted Bishop Fox’s findings reflect the overall trend in lagged patching and show the need for easier and automatic patching processes.

“While the findings from Bishop Fox are shocking, they are not surprising as it mirrors the overall trend in patching lagging significantly behind addressing new exposure in the attack surface, regardless of the technology in question,” Andre van der Walt, director of threat intelligence at Ontinue, said in a statement.

“Until manufacturers make it easy, and automatic patching is simply the default, we will continue to see these kinds of patterns,” echoed John Bambenek, principal threat hunter at Netenrich.

Coalfire VP Andrew Barratt also emphasized the urgent need for security appliance vendors to find near-zero downtime patching techniques for critical infrastructure.