Fortinet Confirms FortiGate SSO Vulnerability Remains Exploitable After Patch
- Securityish
- Threats & Incidents
Quick Summary
Fortinet has acknowledged that attackers are bypassing a December patch for a critical SSO vulnerability in FortiCloud, leading to unauthorized logins on updated devices. The issue affects SAML-based SSO in FortiOS, with reports of compromised accounts and altered firewall settings surfacing since January 15. This ongoing exploitation poses significant risks to users and organizations relying on Fortinet’s security solutions.
The Securityish Brief
Fortinet has confirmed that a December patch intended to fix a critical single sign-on (SSO) vulnerability in FortiCloud is still being exploited. Customers reported suspicious login activity on their devices, even those that had been fully updated. The company identified a new attack path being used to exploit SAML-based SSO in FortiOS, which was discovered following reports of unauthorized changes to firewall settings and the creation of backdoor admin users.
The attacks reportedly began around January 15, with attackers quickly setting up VPN-enabled accounts to extract firewall configuration files. This behavior suggests an automated approach rather than manual intervention. Fortinet’s Chief Information Security Officer, Carl Windsor, noted that the recent incidents closely resemble previous issues reported after the initial patch.
While the exploitation has primarily been observed through FortiCloud SSO, Windsor cautioned that the underlying vulnerability is applicable to all SAML SSO implementations. Fortinet is currently investigating the alternate attack path and has not yet released technical details about it.
In light of these developments, organizations using Fortinet products should be vigilant. The ongoing exploitation of this vulnerability highlights the importance of monitoring authentication logs and reviewing access controls.
Implications for Security Practices
Security teams should take this opportunity to reinforce their monitoring practices. Reviewing authentication logs for any unexpected login activity is crucial, as is restricting access to management interfaces to minimize exposure. Organizations should also closely monitor changes to administrator accounts, as these could indicate unauthorized access.
As the situation evolves, Fortinet customers are advised to remain proactive in their security measures. The company is working on a fix, but until then, vigilance is key to preventing further exploitation.
Key Takeaways
- Review authentication logs for any unexpected login activity on Fortinet devices.
- Restrict access to management interfaces to reduce exposure to potential attacks.
- Monitor changes to administrator accounts closely for any unauthorized modifications.
- Stay updated on Fortinet’s advisories regarding the ongoing vulnerability and any forthcoming patches.
- Consider implementing additional security measures, such as multi-factor authentication, to enhance account protection.
Key Terms & Concepts
- Single Sign-On (SSO): In this article, SSO refers to an authentication process that allows users to access multiple applications with one set of login credentials.
- SAML: SAML stands for Security Assertion Markup Language, a standard used for exchanging authentication and authorization data between parties.
- FortiCloud: FortiCloud is a cloud-based service provided by Fortinet for managing and securing network devices.
- VPN: A VPN, or Virtual Private Network, is a service that creates a secure connection over the internet to protect user data.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2026/01/23/fortinet_fortigate_patch/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
