Fortinet has temporarily disabled FortiCloud single sign-on (SSO) authentication following the discovery of a new zero-day vulnerability actively exploited by threat actors in the wild.
The emergency response comes after multiple customers reported unauthorized access to fully patched devices, indicating a previously unknown attack vector bypassing SAML-based authentication mechanisms.
Vulnerability Background and New Attack Path
In December 2025, Fortinet disclosed two FortiCloud SSO bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719) discovered during internal code audits under advisory FG-IR-25-647.
These flaws allowed unauthenticated attackers to bypass SSO authentication via crafted SAML requests targeting FortiOS, FortiWeb, FortiProxy, and FortiSwitch Manager devices with FortiCloud SSO enabled.​
The current incident represents a distinct and more severe threat. Unlike previous vulnerabilities, this zero-day has successfully compromised devices running the latest firmware versions, suggesting attackers discovered an entirely new exploitation technique.
Fortinet’s product security team has identified the root cause and confirmed that while only FortiCloud SSO exploitation has been observed, the vulnerability affects all SAML SSO implementations across their product ecosystem.​
Timeline of Critical Incident Updates
| Date | Incident Update |
|---|---|
| January 22, 2026 | Initial reports of suspicious login activity on fully patched devices​ |
| January 23, 2026 | Fortinet disabled compromised FortiCloud accounts actively abused in attacks​ |
| January 26, 2026 | FortiCloud SSO completely disabled across platform to prevent further exploitation​ |
| January 27, 2026 | Public advisory FG-IR-26-060 officially released; SSO access restored with restrictions blocking vulnerable devices​ |
Indicators of Compromise
Organizations should immediately check systems for the following malicious artifacts associated with this campaign.
Malicious SSO User Accounts:
Attacker IP Addresses:
| IP Address | Network Infrastructure |
|---|---|
| 104.28.244.115 | Cloudflare-protected infrastructure​ |
| 104.28.212.114 | Cloudflare-protected infrastructure​ |
| 37.1.209.19 | Third-party observed attack source​ |
| 217.119.139.50 | Third-party observed attack source​ |
Malicious Local Admin Accounts Created for Persistence:
- audit
- backup
- itadmin
- secadmin
- support
System administrators should review all administrative accounts for unexpected entries, as attackers have been observed creating local administrator accounts immediately following initial SSO compromise to maintain persistent access.​
Immediate Mitigation Actions
Administrative Access Restriction: Fortinet strongly recommends implementing local-in firewall policies restricting administrative interface access to specific trusted IP addresses. Organizations should never expose edge network devices to unrestricted internet administration.​
Disable FortiCloud SSO: As a temporary workaround, administrators should disable the FortiCloud SSO feature by navigating to System → Settings and switching “Allow administrative login using FortiCloud SSO” to Off, or executing the CLI command: config system global; set admin-forticloud-sso-login disable; end.​
Post-Exploitation Response: If indicators of compromise are detected, organizations must treat device configurations as fully compromised. Fortinet recommends upgrading to the latest firmware (version 7.6 preferred), restoring known clean configurations, and rotating all credentials including connected LDAP and Active Directory accounts.​
FortiCloud SSO access has been restored with updated security controls preventing access from vulnerable devices.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
 authentication following the discovery of a new zero-day vulnerability.){kind=link}