Back Cyberpress

Fortinet SSO Flaw Actively Exploited to Compromise Firewalls and Gain Admin Access

Cyberpress • January 22, 2026

Once exploited , threat actors can escalate privileges and create backdoor administrator accounts, typically named “helpdesk” with full system access.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fortinet SSO Vulnerabilities Exploited for Admin Access on Firewalls Fortinet's Single Sign-On (SSO) vulnerabilities, CVE-2025-59718 and CVE-2025-59719, are being actively exploited by attackers to gain unauthorized administrative access to FortiGate firewalls. These flaws allow unauthenticated attackers to bypass SSO authentication and create local admin accounts, affecting internet-exposed devices. Fortinet's PSIRT team is investigating multiple reports of these attacks. 4 sources 47

Fortinet SSO Flaw Actively Exploited to Compromise Firewalls and Gain Admin Access

The full story

Extracted Entities

Platforms (1)

Vulnerabilities (1)