Automated Forti Gate Attacks Exploit Forti Cloud SSO to Alter Firewall Configurations
Summary: Arctic Wolf reported a new cluster of automated malicious activity beginning January 15, 2026, that made unauthorized configuration changes on Fortinet FortiGate devices by exploiting CVE-2025-59718 and CVE-2025-59719, which allow unauthenticated bypass of SSO login via crafted SAML messages when FortiCloud SSO is enabled. The activity involved malicious SSO logins against the account "cloud-init@mail.io" from four different IP addresses, export of firewall configuration files to those addresses through the GUI, and creation of secondary accounts including "secadmin," "itadmin," "support," "backup," "remoteadmin," and "audit" for persistence, all within seconds of each other.
Why it matters: Attackers created six named persistence accounts and granted them VPN access, then pulled the firewall configurations - meaning the device that defines your network perimeter may already contain accounts you did not create. A Reddit user also stated the Fortinet developer team confirmed the vulnerability persists or is not fixed in version 7.4.10, so patching alone may not close it.