Arctic Wolf detects surge in automated Fortinet FortiGate firewall configuration attacks

Arctic Wolf warned of a new wave of automated attacks making unauthorized firewall configuration changes on Fortinet FortiGate devices, with researchers reporting a cluster observed since 15 January 2026. Attackers reportedly created generic accounts for persistence, enabled VPN access, and exfiltrated firewall configurations, a pattern that mirrors a December 2025 campaign involving admin SSO logins and config theft.

Fortinet disclosed two critical SSO authentication bypass flaws, tracked as CVE-2025-59718 and CVE-2025-59719, which are caused by improper verification of cryptographic signatures. Threat actors began exploiting these flaws days after patches were issued; Arctic Wolf noted attacks on 12 December involved malicious SSO logins targeting admin accounts from multiple hosting providers.

Following access, attackers exported device configurations via the GUI, including hashed credentials, raising the risk of offline cracking and further compromise, with secondary admin accounts often created for persistence. The researchers published Indicators of Compromise (IoCs) to help defenders monitor the evolving threat, according to Arctic Wolf.