FortiCloud SSO bypass hits FortiGates already patched for CVE-2025-59718
Arctic Wolf reported a wave of automated FortiGate intrusions beginning January 15, 2026, in which attackers logged in through FortiCloud SSO, created admin accounts, changed VPN and firewall rules and exported configurations, including on devices running the latest release. Fortinet confirmed on January 22 that a fully upgraded device had been exploited, disabled the two FortiCloud accounts used, temporarily disabled FortiCloud SSO on January 26, and issued advisory FG-IR-26-060 for CVE-2026-24858 on January 27.
- Victim
- Multiple: FortiGate devices with FortiCloud SSO enabled
- Industry
- Technology
- Country
- Global
- Intrusion began
- Jan 15, 2026
- First disclosed
- Jan 22, 2026
- Actor
- Unattributed
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Directory and trust
- MFA
- Not applicable (no interactive login)
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Patching the December SAML bug did not end the trust problem in the cloud SSO path. Turning off vendor cloud SSO for device administration and alerting on new admin accounts mattered more than the patch level.
Go deeper on SWI
- Technique: Federation trust abuse and SAML forgery
- Vulnerability: Fortinet administrative FortiCloud SSO authentication bypass across accounts
- SWI coverage: fortinet sso follow on 24858
Sources
- Analysis of Single Sign-On Abuse on FortiOS, Fortinet, Jan 22, 2026
- FortiGate firewalls hit by silent SSO attacks & config theft, The Register, Jan 22, 2026
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- FortiGate FortiCloud SSO SAML bypass used for admin logins and config theft 2025 · Identity infrastructure vulnerability
- Storm-0558 forged Microsoft tokens to read Exchange Online mail 2023 · Identity infrastructure vulnerability
- BeyondTrust Remote Support zero-day used to dump the appliance credential vault 2026 · Identity infrastructure vulnerability
- N-able N-central authentication bypass used to reach managed customer networks 2026 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). FortiCloud SSO bypass hits FortiGates already patched for CVE-2025-59718. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2026-forticloud-sso-bypass-on-patched-fortigates/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.