Hackers breach Fortinet FortiGate devices, steal firewall configs
Recorded: Jan. 22, 2026, 1:03 p.m.
| Original | Summarized |
Hackers breach Fortinet FortiGate devices, steal firewall configs News Featured Fake Lastpass emails pose as password vault backup alerts Microsoft shares workaround for Outlook freezes after Windows update Fortinet admins report patched FortiGate firewalls getting hacked Hackers exploit security testing apps to breach Fortune 500 firms Hackers exploit 29 zero-days on second day of Pwn2Own Automotive A lifetime subscription to the Mondly language app is now only $8 Hackers breach Fortinet FortiGate devices, steal firewall configs Zendesk ticket systems hijacked in massive global spam wave Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityHackers breach Fortinet FortiGate devices, steal firewall configs Hackers breach Fortinet FortiGate devices, steal firewall configs By Sergiu Gatlan January 22, 2026 Fortinet FortiGate devices are being targeted in automated attacks that create rogue accounts and steal firewall configuration data, according to cybersecurity company Arctic Wolf. That flaw allows unauthenticated attackers to bypass SSO authentication on vulnerable FortiGate firewalls via maliciously crafted SAML messages when FortiCloud SSO features are enabled. config system global The 2026 CISO Budget Benchmark Related Articles: Actively Exploited Sergiu Gatlan Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Popular Stories Fortinet admins report patched FortiGate firewalls getting hacked Ingram Micro says ransomware attack affected 42,000 people New PDFSider Windows malware deployed on Fortune 100 firm's network Sponsor Posts Discover how to scale IT infrastructure reliably without adding toil or burnout. Identity Governance & Threat Detection in one: Get a guided tour of our platform Discover how phishing kits are sold and deployed. Download the full research report. Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Hackers are actively exploiting a vulnerability within Fortinet FortiGate firewalls, specifically targeting the Single Sign-On (SSO) feature and FortiCloud SSO functionality. This exploitation, detailed by cybersecurity firm Arctic Wolf, has resulted in attackers gaining unauthorized access to numerous devices. The core issue revolves around a previously patched flaw – CVE-2025-59718 – which allows unauthenticated attackers to bypass standard authentication protocols and establish admin accounts. This occurred despite Fortinet releasing patches in early December (FortiOS 7.4.9) and subsequent updates, including FortiOS 7.4.10 and 7.4.11, indicating that the vulnerability persists within deployed systems. The attackers are leveraging crafted SAML messages to create these accounts. Arctic Wolf’s investigations revealed that the attackers initiated logins from a specific IP address (104.28.244.114) using the “mail.io” domain, mirroring previous attack patterns observed in December 2025. Log analysis further confirmed the creation of administrative users, solidifying the automated nature of the intrusion. The vulnerability is being compounded by the fact that many FortiGate devices maintain the outdated FortiOS 7.4.10 version, leaving them exposed to this ongoing attack. The extent of the compromise is alarming, with Internet security watchdog Shadowserver currently tracking nearly 11,000 Fortinet devices online and configured with FortiCloud SSO enabled – many of which remain vulnerable due to a delayed patching process. This highlights a critical challenge in cybersecurity: rapid deployment of security updates often lags behind actual threat activity. The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-59718 to its catalog of exploited vulnerabilities, mandating patching within a one-week timeframe for federal agencies. Fortinet has acknowledged the issue and is releasing further patches, including FortiOS 7.4.11, 7.6.6, and 8.0.0, to fully address the problem. However, the situation underscores the need for proactive monitoring and immediate action by Fortinet customers. The attackers’ ability to bypass patches suggests a sophisticated understanding of Fortinet's infrastructure. To mitigate the risk, Arctic Wolf recommends a temporary shutdown of FortiCloud SSO if enabled. This can be achieved through command-line interface commands: `config system global; set admin-forticloud-sso-login disable; end`. Alternatively, administrators can manually disable the feature within the FortiGate’s System -> Settings menu. This is a temporary solution until Fortinet releases a full fix. The ongoing nature of this attack emphasizes the importance of rigorous vulnerability management programs, including continuous monitoring of exposed devices and rapid deployment of patches as they become available. The delayed patching of vulnerable FortiGate devices demonstrates a critical gap in security operations, making these devices prime targets for malicious actors. The continued investigation and tracking of these events by Arctic Wolf and Shadowserver are crucial in understanding the evolving threat landscape and informing effective defensive strategies. |