Fortinet SSO Bypass – Act Now

Latest Posts
Threats
Vulnerabilities

Fortinet SSO Bypass – Act Now

by Mike Puglia

2 min read

UPDATE Jan 22 6:20PM EST

Fortinet has provided an update at: https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios

Fortinet has confirmed the patch in December did not fully resolve the issue. Specifically, they state:

“Fortinet product security has identified the issue, and the company is working on a fix to remediate this occurrence. An advisory will be issued as the fix scope and timeline is available. It is important to note that while, at this time, only exploitation of FortiCloud SSO has been observed, this issue is applicable to all SAML SSO implementations.“

This expands the scope of the attack beyond just FortiCloud SSO. Disabling FortiCloud SSO may not mitigate all compromises. Customers must follow the guidance provided by Fortinet to restrict administrative access from the internet (which is best practice).

Original Post

Kaseya Labs has recently posted on both recent and older exploited vulnerabilities in Fortinet firewalls (see article here). However, we have seen and it has been widely reported that customers are still seeing compromised of fully patched firewalls which may be related to CVE-2025-59718 which was resolved in December of 2025. Whether the patch did not successfully address the vulnerability or this is a new exploit is unknown and as of this writing Fortinet has not yet made public comments.

Given the potential impact, it is recommended that customers take immediate action to disable this feature to potentially mitigate the threat until Fortinet issues additional guidance using the vendor instructions below:

To turn off FortiCloud login, go to System -> Settings -> Switch
“Allow administrative login using FortiCloud SSO” to Off. Or type the
following command in the CLI:

config system global
set admin-forticloud-sso-login disable
end

Additionally, it has been observed that in some compromises the attackers have created additional admin accounts on the firewall to establish persistence, in which case, they would now have a direct login without SSO (rendering the above referenced mitigation ineffective) It is recommended to review each admin account is valid (via the GUI go to System->Administrators) and review logs for new admins added (Go to Log->Reports and filter on Event Type=System and Subtype=Admin and look for administrator created or added).

Mike Puglia

General Manager, Security Products

Mike Puglia brings over 25 years of technology, strategy, and cybersecurity experience to his role as Kaseya’s General Manager of Security Products. He is responsible for all products across Kaseya’s portfolio of security solutions.

Prior to joining Kaseya, Mike led the technical program management integration of real-time collaboration technologies into Salesforce’s Chatter Social Enterprise platform. Earlier in his career, Mike served in technical and product roles at applications security company Veracode, database security company Lumigent Technologies and network security Bluesocket.

Mike holds a Bachelor of Science in Electrical Engineering from the University of New Hampshire and an MBA from the Carroll Graduate School of Management at Boston College.