Fortinet Confirms FortiCloud SSO Bypass Vulnerability on Patched Firewalls

Fortinet has acknowledged a serious vulnerability affecting its FortiGate firewalls, specifically concerning the FortiCloud SSO authentication mechanism. Reports indicate that even devices fully upgraded to the latest software were exploited, suggesting a new attack vector. This vulnerability is linked to CVE-2025-59718 and CVE-2025-59719, which were previously addressed by Fortinet in December 2025.

In recent incidents, threat actors have been observed using generic accounts to gain unauthorized access, make configuration changes, and exfiltrate firewall settings. Accounts such as “cloud-noc@mail.io” and “cloud-init@mail.io” have been utilized for these malicious activities. The renewed exploitation activity was noted just weeks after the vulnerabilities were disclosed, indicating a persistent threat.

Fortinet’s Chief Information Security Officer, Carl Windsor, highlighted that the exploitation of FortiCloud SSO has been confirmed, but the implications extend to all SAML SSO implementations. This broadens the potential impact beyond just Fortinet’s products, raising concerns for organizations using similar authentication methods.

Understanding the Risks

The ongoing exploitation of this vulnerability underscores the importance of maintaining strict security protocols for network devices. Organizations must be vigilant in monitoring their systems for unauthorized access attempts and ensure that all security patches are applied promptly.

As the threat landscape evolves, similar vulnerabilities may emerge in other systems. Users and organizations should regularly review their security configurations and access controls to mitigate risks associated with SSO implementations.

Fortinet has recommended specific mitigations, including restricting administrative access and disabling FortiCloud SSO logins. These actions are crucial for protecting sensitive configurations and preventing unauthorized access.

• Restrict administrative access of edge network devices via the internet by applying a local-in policy.
• Disable FortiCloud SSO logins by disabling “admin-forticloud-sso-login.”
• Regularly monitor logs for unauthorized access attempts and unusual account activity.
• Ensure all network devices are updated with the latest security patches.
• Review and tighten access controls for all SSO implementations to prevent exploitation.