Fortinet admins report patched FortiGate firewalls getting hacked
Recorded: Jan. 21, 2026, 6:03 p.m.
| Original | Summarized |
Fortinet admins report patched FortiGate firewalls getting hacked News Featured Credential-stealing Chrome extensions target enterprise HR platforms Microsoft releases OOB Windows updates to fix shutdown, Cloud PC bugs Jordanian pleads guilty to selling access to 50 corporate networks Ingram Micro says ransomware attack affected 42,000 people Fortinet admins report patched FortiGate firewalls getting hacked Fake Lastpass emails pose as password vault backup alerts Microsoft shares workaround for Outlook freezes after Windows update You Got Phished? Of Course! You're Human... Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityFortinet admins report patched FortiGate firewalls getting hacked Fortinet admins report patched FortiGate firewalls getting hacked By Sergiu Gatlan January 21, 2026 Fortinet customers are seeing attackers exploiting a patch bypass for a previously fixed critical FortiGate authentication vulnerability (CVE-2025-59718) to hack patched firewalls. One of the affected admins said that Fortinet has allegedly confirmed that the latest FortiOS version (7.4.10) didn't fully address this authentication bypass vulnerability, which should've been patched in early December with the release of FortiOS 7.4.9. "We just had a malicious SSO login on one of our FortiGate's running on 7.4.9 (FGT60F). We have a SIEM that caught the local admin account being created. Now, I have done a little research, and it appears this is exactly how it looked when someone came in on CVE-2025-59718. But we have been on 7.4.9 since December 30th," the admin said. Until Fortinet provides a fully patched FortiOS release, admins are advised to temporarily disable the vulnerable FortiCloud login feature (if enabled) to secure their systems against attacks. config system global Secrets Security Cheat Sheet: From Sprawl to Control Related Articles: Bypass Sergiu Gatlan Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Popular Stories Microsoft releases OOB Windows updates to fix shutdown, Cloud PC bugs Ingram Micro says ransomware attack affected 42,000 people New PDFSider Windows malware deployed on Fortune 100 firm's network Sponsor Posts Discover how phishing kits are sold and deployed. Download the full research report. Identity Governance & Threat Detection in one: Get a guided tour of our platform Discover how to scale IT infrastructure reliably without adding toil or burnout. Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Fortinet is facing a significant security challenge stemming from a persistent vulnerability within its FortiGate firewall systems. Reports indicate that patched versions of FortiOS, specifically 7.4.9 and subsequent releases like 7.4.10, are failing to fully address a critical authentication bypass flaw, designated as CVE-2025-59718. This vulnerability, which allows attackers to gain administrative access to the firewalls, was initially identified in December 2025 and continues to be actively exploited. Multiple Fortinet administrators have independently confirmed the ongoing issue, detailing instances where malicious Single Sign-On (SSO) logins, originating from IP address 104.28.244.114, were successfully used to create new system administrator accounts within their FortiGate systems. These attacks closely mirror those previously reported by Arctic Wolf, further showcasing the vulnerability’s persistence. The core of the issue revolves around an improper handling of SAML messages during the FortiCloud SSO authentication process. Attackers are leveraging this oversight to circumvent standard security checks and escalate privileges. BleepingComputer’s attempts to obtain a direct response from Fortinet regarding these reports have been unsuccessful. This lack of communication exacerbates the situation and raises concerns about the company’s responsiveness to critical security issues. Shadowserver’s monitoring has revealed a concerning number of vulnerable Fortinet devices exposed online with FortiCloud SSO enabled. As of mid-December, over 25,000 devices were detectable, with a significant portion – more than half – having been secured after the initial discovery. However, Shadowserver continues to track approximately 11,000 devices still reachable through the internet, highlighting the ongoing challenge of securing these systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2025-59718 to its list of actively exploited vulnerabilities, mandating that federal agencies prioritize patching within a one-week timeframe. This urgency underscores the severity of the risk. Adding to the complexity, attackers are concurrently exploiting a separate critical FortiSIEM vulnerability, supported by publicly available proof-of-concept exploit code, allowing for code execution with root privileges on unpatched systems. To mitigate the immediate threat, administrators are advised to temporarily disable the FortiCloud login feature (if enabled) and executing the command sequence: `config system global; set admin-forticloud-sso-login disable; end` via the command-line interface. Despite Fortinet’s recommended approach, continuous monitoring and immediate action are vital. The persistence of this vulnerability underscores a need for improved authentication methodologies and stricter security protocols within Fortinet firewall deployments. The incident brings into sharp focus the critical importance of proactive vulnerability management and the potential consequences of unaddressed security weaknesses within widely deployed network infrastructure. |