Fortinet Confirms Active FortiCloud SSO Bypass Explo

Fortinet has confirmed active exploitation of a FortiCloud SSO authentication bypass vulnerability, with a new automated campaign now targeting even fully patched FortiGate devices.

Cybersecurity firm Arctic Wolf first observed the attacks on January 15, 2026, involving rapid configuration exfiltration and persistence via generic admin accounts.

In December 2025, Fortinet disclosed two critical vulnerabilities, CVE-2025-59718 and CVE-2025-59719 (FG-IR-25-647), enabling unauthenticated attackers to bypass SSO authentication using crafted SAML messages when FortiCloud SSO is enabled.

These flaws affect FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, allowing admin access without credentials. Patches were issued, but recent incidents on updated firmware like 7.4.10 indicate a persistent or variant issue applicable to all SAML SSO implementations.

Affected Versions

Fortinet’s PSIRT advisory details vulnerable versions and fixes.

Reports confirm exploitation on 7.4.9, 7.4.10, and 7.6.x, with fixes scheduled for later releases.

Attack Campaign Details

Arctic Wolf telemetry reveals highly automated attacks mirroring December 2025 activity. Threat actors use malicious SSO logins (e.g., [email protected]), exfiltrate configs via GUI for offline credential cracking, then create persistence accounts granting VPN access.

Incidents occur seconds apart, targeting internet-exposed devices; over 25,000 had SSO enabled per prior scans. Field Effect notes compromises on the latest FortiOS despite patches.

Combined IOCs from Fortinet, Arctic Wolf, and reports.

Search logs for SSO successes from these IPs/users and “Add system.admin” events.

Immediate Mitigations

Fortinet urges disabling FortiCloud SSO:

textconfig system global
set admin-forticloud-sso-login disable
end

Implement local-in policies to restrict admin access:

textconfig firewall local-in-policy
edit 1
set intf "port1"
set srcaddr "10.10.10.0"  # Trusted subnet
set dstaddr "all"
set service "HTTPS"
set schedule "always"
next
end

Treat compromised devices as fully owned: upgrade to the latest firmware (e.g., 7.6.x), restore clean configs, rotate all credentials, including LDAP/AD, and audit VPN settings.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.