Loading story…
Truesec reported that attackers exploited FortiGate FortiCloud SSO vulnerabilities CVE-2025-59718 and CVE-2025-59719 to gain unauthorized administrative access to vulnerable firewalls, provided FortiCloud SSO was enabled and the management interface was reachable. Using a valid FortiCloud account, the attackers generated a malicious SAML assertion accepted by the device, allowing them to take control of the firewall and extract its configuration.
Investigations found the stolen configurations contained high-value secrets, including SSL VPN credentials and Active Directory integration accounts, which attackers used to modify VPN policies and NAT behavior, scan internal networks, exfiltrate data, and deploy ransomware through the Domain Controller. Truesec also described a technique in which attackers loaded a stolen configuration onto a controlled FortiGate device and downgraded FortiOS so stored passwords were re-encrypted with a weaker scheme, enabling rapid recovery of plaintext credentials and accelerating lateral movement toward full domain compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
After gaining broader access, attackers performed network scanning, exfiltrated data, and deployed ransomware, including via the Domain Controller in the cases Truesec examined. The incidents demonstrated progression from firewall compromise to full environment impact.
In the investigated incidents, attackers downloaded firewall configurations from compromised FortiGate devices and used valid SSL VPN credentials found in those files. They also modified VPN-related firewall policies and NAT behavior to support further intrusion.
Truesec described a technique in which attackers load a stolen configuration onto a FortiGate device and downgrade FortiOS so stored passwords are re-encrypted with an older, weaker scheme. This enables rapid recovery of plaintext credentials from stolen configurations.
Truesec CSIRT reported analyzing multiple incidents involving exploitation of FortiCloud SSO vulnerabilities CVE-2025-59718 and CVE-2025-59719, which allowed unauthorized administrative access to vulnerable FortiGate devices. The cases showed that compromise of a perimeter device could be escalated into broader environment compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcetruesec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two critical authentication bypass vulnerabilities, CVE-2025-59718 and CVE-2025-59719, have been identified in Fortinet products utilizing the FortiCloud SSO login feature. These flaws stem from improper verification of cryptographic signatures (CWE-347), allowing unauthenticated attackers to bypass SSO authentication and potentially gain administrative access. The vulnerabilities affect multiple Fortinet product lines, including FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, when FortiCloud SSO is enabled. Fortinet has clarified that FortiCloud SSO is disabled by default, but it becomes enabled if devices are registered via FortiCare through the GUI unless the relevant setting is manually disabled. Following public disclosure of these vulnerabilities, Arctic Wolf observed active exploitation attempts targeting FortiGate appliances. Malicious SSO logins were traced to several hosting providers, with attackers typically attempting to access the admin account. Indicators of compromise (IOCs) include specific IP addresses from The Constant Company LLC, Bl Networks, and Kaopu Cloud HK Limited. Organizations using affected Fortinet products are urged to review their SSO configurations, apply vendor patches, and monitor for suspicious login activity, especially from the identified IOCs.
Jun 29, 2026
Arctic Wolf and multiple Fortinet customers reported ongoing intrusions against **Fortinet FortiGate** devices involving **malicious SSO logins** followed by **unauthorized configuration changes**, including creation of new admin/persistent accounts, granting VPN access, and **exfiltration of firewall configurations**. Arctic Wolf observed the activity beginning **January 15, 2026**, describing it as automated and similar to exploitation patterns previously tied to crafted SAML messages when *FortiCloud SSO* is enabled, consistent with earlier reporting around **CVE-2025-59718** and **CVE-2025-59719**. Administrators reported compromises occurring even on systems believed to be patched, indicating a **patch bypass or incomplete fix** for **CVE-2025-59718** in FortiOS releases intended to remediate the issue (with claims that **FortiOS 7.4.10** still did not fully address the vulnerability). Shared logs described SSO logins (e.g., `cloud-init@mail.io`) from specific IP infrastructure (e.g., `104.28.244.114`) followed by creation of new admin users such as `helpdesk`, matching the TTPs Arctic Wolf previously documented. Fortinet was reportedly preparing additional FortiOS releases (e.g., **7.4.11**, **7.6.6**, **8.0.0**) to fully remediate, while defenders were advised to consider temporarily disabling the vulnerable SSO functionality pending a confirmed fix.
Jun 29, 2026
Attackers have been actively targeting internet-exposed **Fortinet FortiGate** management interfaces to seize administrative control of firewalls, with reporting tying the activity to exploitation of **`CVE-2024-55591`** and a related authentication weakness, **`CVE-2025-24472`**. Fortinet said the primary flaw affects **FortiOS** and **FortiProxy** and stems from improper authentication in the Node.js websocket module, allowing an unauthenticated remote attacker to obtain **super-admin** access and full control of vulnerable devices. Observed intrusions included the creation of new administrator accounts, adding those accounts to **SSL VPN** groups, changing firewall policies, and using the compromised appliances to pivot into networks that were otherwise protected behind the VPN perimeter. Security guidance accompanying the disclosures urged organizations to apply Fortinet patches immediately, disable or restrict public exposure of management interfaces, harden FortiOS devices, and review logs for signs of compromise tied to the broader campaign against exposed firewall consoles.
Jul 24, 2026