Automated Attacks Exploit FortiCloud SSO Vulnerabilities in FortiGate Firewalls

Arctic Wolf has identified a new wave of automated malicious activity affecting Fortinet FortiGate devices, starting on January 15, 2026. This activity is linked to unauthorized firewall configuration changes made via malicious single sign-on (SSO) logins. The vulnerabilities exploited are CVE-2025-59718 and CVE-2025-59719, which allow attackers to bypass SSO login authentication using crafted SAML messages.

These vulnerabilities impact several Fortinet products, including FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. The attacks involve the creation of generic accounts, such as “cloud-init@mail.io,” from multiple IP addresses, which are then used to alter firewall settings and exfiltrate configuration files. The source IP addresses identified in these attacks include 104.28.244[.]115, 104.28.212[.]114, 217.119.139[.]50, and 37.1.209[.]19.

In addition to the initial account, threat actors have been observed creating secondary accounts like “secadmin,” “itadmin,” and “support” to maintain access. The rapid sequence of these events suggests a high level of automation in the attack process.

This situation is compounded by reports from users on Reddit, indicating that even fully-patched FortiOS devices are vulnerable, with claims that the issue persists in version 7.4.10. As of now, Fortinet has not publicly commented on the situation.

Implications for Security

Organizations using Fortinet products should be aware of the potential risks associated with these vulnerabilities. The ability for attackers to bypass authentication and alter configurations can lead to unauthorized access and data breaches.

It is crucial for users to monitor their firewall configurations closely and be vigilant for any unauthorized changes. Given the nature of these attacks, organizations should consider disabling the “admin-forticloud-sso-login” setting to mitigate risks.

Regularly updating software and applying security patches is essential to protect against known vulnerabilities. Organizations should also review their account management practices to ensure that only necessary accounts are created and maintained.

• FortiOS: A core operating system for Fortinet’s network security devices.
• FortiWeb: A web application firewall designed to protect web applications from attacks.
• FortiProxy: A secure web gateway that provides advanced threat protection.
• FortiSwitchManager: A management tool for Fortinet’s switch products.