Fortinet Confirms Active Forti Cloud SSO Bypass on Fully Patched Forti Gate Firewalls
Summary: Fortinet CISO Carl Windsor confirmed that in the last 24 hours the company identified cases where an exploit hit FortiGate devices fully upgraded to the latest release, suggesting a new attack path that bypasses the patches for CVE-2025-59718 and CVE-2025-59719. The activity involves malicious SSO logins against the admin account, creation of generic accounts for persistence, configuration changes granting those accounts VPN access, and exfiltration of firewall configurations to different IP addresses, with logins seen from accounts named "cloud-noc@mail.io" and "cloud-init@mail.io."
What you should know: The exploit worked on firewalls already running the latest release, so patch status alone did not stop the attacker - and Fortinet notes the issue applies to all SAML SSO implementations, not just FortiCloud SSO.
Read the original at The Hacker News ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2025-59718CVE-2025-59719
- Related