Attackers are exploiting a previously patched critical FortiGate authentication flaw (CVE-2025-59718) through a patch bypass method to breach protected firewalls, as Fortinet customers are experiencing. Fortinet reportedly plans to soon release FortiOS versions 7.4.11, 7.6.6, and 8.0.0 to fully address the security vulnerability.
An affected administrator stated that the latest FortiOS release (7.4.10) does not fully address the authentication bypass vulnerability. The vulnerability was expected to be fixed with the release of FortiOS 7.4.9, scheduled for early December.
“We just had a malicious SSO on one of our FortiGates running version 7.4.9 (FGT60F). We have a SIEM that detected the creation of the local administrator account. Now, I did a little research and it looks like this is exactly what happened when someone broke in with CVE-2025-59718. But we’ve been on version 7.4.9 since December 30th,” the administrator said.
Until Fortinet provides a fully patched version of FortiOS, administrators are advised to temporarily disable the vulnerable FortiCloud login feature (if enabled) to protect their systems from attacks.
“We’ve observed the same activity. Also running version 7.4.9. Same user login and IP address. A new sysadmin user named ‘helpdesk’ has been created. We have an open ticket with support. Update: The Fortinet development team has confirmed that the vulnerability persists or has not been fixed in version 7.4.10,” another added.
To disable access to FortiCloud, you need to go to System -> Settings and disable the “Allow administrative access via FortiCloud SSO” option. Alternatively, you can run the following commands from the command line interface:
Fortunately, as Fortinet explains in its original advisory, the FortiCloud Single Sign-On (SSO) feature targeted by the attacks is not enabled by default when the device is not enrolled in FortiCare, which should reduce the total number of vulnerable devices.
Follow us on Google News to receive daily updates on cybersecurity. Contact us if you would like to report news, insights or content for publication.
