Fortinet has acknowledged an active authentication bypass vulnerability targeting the FortiCloud Single Sign-On (SSO) feature on FortiGate firewalls, including devices fully patched against previously disclosed vulnerabilities CVE-2025-59718 and CVE-2025-59719. These earlier CVEs involved unauthenticated bypass of SSO login via crafted SAML messages. However, recent exploitation activity indicates attackers have discovered a new attack path that circumvents the existing patches, allowing unauthorized access to administrative accounts without valid credentials. The attackers leverage this bypass to log in as admin, create generic persistent accounts, alter firewall configurations to grant VPN access to these accounts, and exfiltrate sensitive firewall configuration data to external IP addresses. The threat actors have been observed using accounts such as "cloud-noc@mail.io" and "cloud-init@mail.io" for these activities. Fortinet’s CISO Carl Windsor confirmed these incidents and emphasized that while exploitation currently targets FortiCloud SSO, the underlying issue affects all SAML SSO implementations, highlighting a broader risk. Fortinet recommends immediate mitigation steps including disabling the "admin-forticloud-sso-login" feature and applying local-in policies to restrict administrative access from the internet. The vulnerability impacts critical network security infrastructure, potentially allowing attackers to gain persistent, unauthorized administrative control over firewalls, which could lead to further network compromise, data exfiltration, and disruption of services.

For European organizations, this vulnerability poses a significant threat to network security and operational continuity. FortiGate firewalls are widely deployed across enterprises, government agencies, and critical infrastructure sectors in Europe, making the impact potentially widespread. Unauthorized administrative access can lead to the creation of backdoor accounts, unauthorized VPN access, and exfiltration of sensitive firewall configurations, which may contain network topology and security policy information. This can facilitate lateral movement within networks, data breaches, and disruption of security controls. The bypass affects confidentiality by exposing sensitive configuration data, integrity by allowing unauthorized configuration changes, and availability by potentially disrupting firewall operations or enabling denial of service. Given the ease of exploitation without authentication and no user interaction, attackers can rapidly compromise vulnerable devices. The impact is exacerbated in sectors with stringent regulatory requirements such as finance, healthcare, and critical infrastructure, where firewall compromise can have cascading effects on national security and public safety.

European organizations should immediately implement the following specific mitigations: 1) Disable the FortiCloud SSO login feature by setting "admin-forticloud-sso-login" to disabled to prevent exploitation of the bypass. 2) Apply strict local-in policies to restrict administrative access to FortiGate firewalls from the internet, limiting it to trusted management networks only. 3) Conduct thorough audits of firewall user accounts to identify and remove any unauthorized or suspicious accounts, especially those resembling "cloud-noc@mail.io" or "cloud-init@mail.io." 4) Monitor firewall logs for unusual administrative login activity and configuration changes, employing SIEM tools with alerting for anomalous behavior. 5) Review and tighten VPN access policies to prevent unauthorized account usage. 6) Engage with Fortinet support for any updated patches or hotfixes addressing this new attack vector as they become available. 7) Educate network security teams about the risks associated with SAML SSO implementations and consider additional multi-factor authentication layers where feasible. 8) Implement network segmentation to limit the impact of compromised firewalls. These measures go beyond generic advice by focusing on configuration changes, active monitoring, and account hygiene tailored to this specific threat.