Fortinet FortiGate Devices Breached in Automated Attacks Exploiting SSO Vulnerability
- Securityish
- Threats & Incidents
Quick Summary
Fortinet FortiGate devices are under attack, with hackers exploiting a vulnerability in the single sign-on (SSO) feature to create rogue accounts and steal firewall configurations. This campaign began on January 15, 2025, and is linked to a previously disclosed authentication bypass vulnerability (CVE-2025-59718). Affected customers report that even patched firewalls are being compromised, highlighting ongoing security risks for users and organizations relying on Fortinet products.
The Securityish Brief
Fortinet FortiGate devices are currently facing automated attacks that exploit a vulnerability in the single sign-on (SSO) feature. These attacks began on January 15, 2025, and involve creating unauthorized accounts with VPN access and quickly exporting firewall configurations. Cybersecurity firm Arctic Wolf has linked this campaign to a similar incident documented in December 2025, which involved the exploitation of the CVE-2025-59718 vulnerability.
The CVE-2025-59718 flaw allows unauthenticated attackers to bypass SSO authentication on vulnerable FortiGate firewalls by using maliciously crafted SAML messages. Despite the release of patches, reports from Fortinet customers indicate that attackers are still able to exploit patched firewalls, suggesting that the vulnerabilities may not have been fully addressed.
Fortinet has acknowledged the issue and plans to release additional updates, including FortiOS versions 7.4.11, 7.6.6, and 8.0.0, to fully resolve the CVE-2025-59718 security flaw. The ongoing attacks have been tracked by internet security watchdog Shadowserver, which reports nearly 11,000 Fortinet devices with FortiCloud SSO enabled are exposed online.
Implications for Security
For organizations using Fortinet products, the current situation raises significant security concerns. The ability of attackers to create admin users and access sensitive configurations poses a serious risk to network integrity and data security. Users should be particularly vigilant if they have enabled FortiCloud SSO, as this feature is currently a target for exploitation.
As CISA has added CVE-2025-59718 to its catalog of known exploited vulnerabilities, federal agencies are required to patch their systems promptly. This highlights the urgency for all Fortinet customers to review their configurations and apply necessary updates as soon as they are available.
In light of these developments, organizations should consider disabling FortiCloud SSO until a complete patch is confirmed. This proactive measure can help mitigate the risk of unauthorized access and protect sensitive firewall configurations.
- Fortinet FortiGate devices are being targeted in automated attacks exploiting SSO vulnerabilities.
- The campaign started on January 15, 2025, indicating a rapid escalation of threats.
- Cybersecurity firm Arctic Wolf has linked this activity to previous incidents involving CVE-2025-59718.
- Nearly 11,000 Fortinet devices are reported to be exposed online with FortiCloud SSO enabled.
- CISA has ordered federal agencies to patch systems against these vulnerabilities.
Key Takeaways
- Disable FortiCloud SSO in your Fortinet settings to prevent unauthorized access.
- Regularly check for updates from Fortinet and apply patches as soon as they are released.
- Monitor your firewall logs for any suspicious activity or unauthorized account creation.
- Educate your team about the risks associated with SSO vulnerabilities and best practices for security.
- Consider implementing additional security measures, such as multi-factor authentication, to enhance protection.
Key Terms & Concepts
- CVE-2025-59718: In this article, CVE-2025-59718 refers to a critical authentication bypass vulnerability in Fortinet products that allows unauthorized access.
- FortiCloud SSO: FortiCloud SSO is a single sign-on feature for Fortinet devices that enables administrative access through FortiCloud.
- Arctic Wolf: Arctic Wolf is a cybersecurity company that monitors and reports on security incidents, including attacks on Fortinet devices.
Read the original article here: https://www.bleepingcomputer.com/news/security/hackers-breach-fortinet-fortigate-devices-steal-firewall-configs/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
