Uncovering Automated Attacks on Fortinet FortiGate Devices
Rising Threat: Automated Malicious Activity
A new wave of automated cyberattacks has been targeting Fortinet FortiGate devices, as revealed by cybersecurity company Arctic Wolf. These attacks, commencing on January 15, 2026, share similarities with a December 2025 campaign that exploited vulnerabilities CVE-2025-59718 and CVE-2025-59719 to carry out unauthorized SSO logins on FortiGate appliances.
Method of Operation: Unauthenticated Bypass of SSO Login Authentication
The shortcomings in FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager allow for unauthenticated bypass of SSO login authentication via crafted SAML messages when the FortiCloud single sign-on (SSO) feature is enabled on affected devices.
Impact: Configuration Changes and Data Exfiltration
This activity involves creating generic accounts for persistence, configuration changes granting VPN access to those accounts, and exfiltration of firewall configurations. The threat actors have also been observed creating secondary accounts for persistence.
Relevance to North East India and India
Given the widespread use of Fortinet devices across various industries in India, including North East India, these attacks pose a significant risk. It is crucial for organizations to stay vigilant and take necessary measures to secure their networks.
Reflections and Moving Forward
As organizations continue to digitize their operations, the threat landscape becomes increasingly complex. It is essential to stay informed about emerging threats and adopt best practices for network security. In this case, disabling the "admin-forticloud-sso-login" setting is a recommended temporary measure until a more permanent solution is found.