New Wave of Attacks Targeting FortiGate Firewalls

SecurityWeek reports a new wave of attacks targeting FortiGate firewalls, with threat actors performing malicious SSO logins to create new accounts, change VPN configurations, and exfiltrate device data, according to Arctic Wolf. The activity mirrors a December 2025 campaign that exploited two critical Fortinet flaws, CVE-2025-59718 and CVE-2025-59719, which carry a CVSS score of 9.8 and allow bypass of FortiCloud SSO login via crafted SAML responses.

Arctic Wolf notes that the attacks began after Fortinet published patches for these vulnerabilities, yet it remains unclear whether the ongoing activity is fully covered by those patches. Researchers say the malicious logins often originate from a small number of hosting providers and target the FortiCloud-enabled account, exporting device configurations within seconds of login.

To mitigate risk, users are advised to disable the FortiCloud login feature by turning off “Allow administrative login using FortiCloud SSO” in the settings, as outlined in SecurityWeek’s reporting by Ionut Arghire on 22 January 2026.