Fortinet FortiOS/FortiProxy/FortiSwitchManager: Authentication bypass in FortiCloud SSO

Summary

Fortinet FortiOS, FortiProxy and FortiSwitchManager do not properly verify cryptographic signatures in the FortiCloud SSO login. An unauthenticated remote attacker can send a crafted SAML response to bypass the login and gain administrative access. This requires FortiCloud SSO login to be enabled on the device, which is off by default but is switched on when a device is registered to FortiCare via the GUI unless the toggle is disabled. Exploitation is confirmed and the vulnerability is listed in the CISA KEV catalog.

Affected

• FortiOS 7.6.0 to 7.6.3
• FortiOS 7.4.0 to 7.4.8
• FortiOS 7.2.0 to 7.2.11
• FortiOS 7.0.0 to 7.0.17
• FortiProxy 7.6.0 to 7.6.3
• FortiProxy 7.4.0 to 7.4.10
• FortiProxy 7.2.0 to 7.2.14
• FortiProxy 7.0.0 to 7.0.21
• FortiSwitchManager 7.2.0 to 7.2.6
• FortiSwitchManager 7.0.0 to 7.0.5
• FortiOS 6.4 is not affected

Fixed in

• FortiOS 7.6.4 or above
• FortiOS 7.4.9 or above
• FortiOS 7.2.12 or above
• FortiOS 7.0.18 or above
• FortiProxy 7.6.4 or above
• FortiProxy 7.4.11 or above
• FortiProxy 7.2.15 or above
• FortiProxy 7.0.22 or above
• FortiSwitchManager 7.2.7 or above
• FortiSwitchManager 7.0.6 or above
• FortiSASE 25.3.b (no customer action required)

Workaround

• Disable FortiCloud SSO admin login until the device is upgraded: System > Settings > "Allow administrative login using FortiCloud SSO" to Off, or CLI: config system global, set admin-forticloud-sso-login disable, end
• When registering a device to FortiCare, disable the "Allow administrative login using FortiCloud SSO" toggle on the registration page.

Exploitation

• Actively exploited. Arctic Wolf observed malicious SSO logins from 12 December 2025, mostly against admin accounts.
• Added to the CISA KEV catalog on 16 December 2025.
• Public proof-of-concept code exists, but its quality is mixed according to VulnCheck.
• Arctic Wolf reported a later campaign from 15 January 2026 that created persistent accounts, configured VPN access and exported firewall configurations. It is unknown whether the initial patch fully covers this activity.

Our recommendation

• Inventory all FortiOS, FortiProxy and FortiSwitchManager devices and their versions.
• Check whether FortiCloud SSO admin login is enabled and disable it if it is not required.
• Update to the fixed versions listed in the Fortinet advisory FG-IR-25-647.
• Check for CVE-2026-24858, a related FortiCloud SSO bypass, and verify that the installed version contains the complete fix.
• Restrict administrative interface access to management networks only and never expose it to the internet.
• Review logs from 12 December 2025 onward for unknown admin or VPN accounts, configuration changes and logins from unfamiliar hosting-provider IP addresses.
• If signs of compromise are found, reset all firewall credentials, including hashed credentials in exported configurations, and review VPN accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (2 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  exfil0/CVE-2025-59718-PoC · moften/CVE-2025-59718-Fortinet-Poc

Research sources

• Fortinet PSIRT FG-IR-25-647 fortiguard.fortinet.com
• Arctic Wolf: Malicious SSO logins following disclosure arcticwolf.com
• Arctic Wolf: Malicious configuration changes via SSO accounts arcticwolf.com
• CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
• Fortinet blog: Analysis of SSO abuse on FortiOS www.fortinet.com
• VulnCheck: FortiCloud SSO login bypass www.vulncheck.com
• Siemens ProductCERT SSA-864900 cert-portal.siemens.com
• Help Net Security: FortiGate vulnerability exploited www.helpnetsecurity.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:30.