Fortinet firewalls are under threat from a single sign-on (SSO) vulnerability, which allows unauthorized configuration changes.

According to researchers at Arctic Wolf, the exploit hinges on vulnerabilities (CVE-2025-59718, CVE-2025-59719) discovered in early December. In an advisory, Fortinet explained that flawed cryptographic signature verification in FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager enables bad actors to bypass the FortiCloud SSO login authentication via a crafted security assertion markup language (SAML) message, should the device have that feature enabled.

Following the disclosure, Arctic Wolf found intrusions involving malicious SSO logins on FortiGate appliances, explaining: “This activity involved the creation of generic accounts intended for persistence, configuration changes granting VPN access to those accounts, as well as exfiltration of firewall configurations.”

Attackers primarily targeted the [email protected] account, successfully logging in and immediately exporting device configurations through the user interface. Secondary administrator accounts for persistence were then whipped up in seconds, suggesting an autonomous nature to the exploit.

The researchers added it was not yet known whether the new activity is covered by the patch issued by Fortinet for the original issue.

The firewall issue comes after more than 10,000 Fortinet firewalls were reported to be at risk from a legacy vulnerability affecting FortiGate SSL VPN.

Revealed in January, the vulnerability allows users to log in without being prompted for two-factor authentication (2FA) if they changed the case of their username. Affecting FortiOS versions 6.4.0, 6.2.0 to 6.2.3, and 6.0.9, users were recommended at the time to upgrade to newer versions of the operating system.