Back Cybersecuritynews

Fortinet Confirms Active Exploitation of FortiCloud SSO Authentication Bypass Vulnerability

Cybersecuritynews •Guru Baran • January 23, 2026

Fortinet confirms active exploitation of a FortiCloud SSO authentication bypass vulnerability, with a new automated campaign targeting even fully patched FortiGate devices. Cybersecurity firm Arctic Wolf first observed the attacks on January 15, 2026, involving rapid configuration exfiltration and persistence via generic admin accounts. In December 2025, Fortinet disclosed two critical vulnerabilities, CVE-2025-59718 and CVE-2025-59719 […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fortinet Confirms Exploitation of FortiCloud SSO Bypass Vulnerability Fortinet has confirmed that attackers are actively exploiting a vulnerability in FortiCloud's single sign-on (SSO) authentication, affecting even fully patched devices. The exploitation allows unauthorized access, with attackers bypassing security measures that were thought to be effective following a December patch. Organizations are advised to monitor their systems closely for suspicious activity. 35 sources 38

Extracted Entities

Fortinet Confirms Active Exploitation of FortiCloud SSO Authentication Bypass Vulnerability

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (2)

Platforms (2)

Vulnerabilities (1)