---
title: "Fortinet Confirms Active FortiCloud SSO Bypass on Fully Patched FortiGate Firewalls"
url: https://daily.dev/posts/fortinet-confirms-active-forticloud-sso-bypass-on-fully-patched-fortigate-firewalls-b0r3dojod
source_url: https://thehackernews.com/2026/01/fortinet-confirms-active-forticloud-sso.html
type: article
source: "The Hacker News"
published: 2026-01-23T12:59:52.065Z
updated: 2026-02-27T20:50:40.874Z
tags: ["security", "cyber", "authentication", "fortinet"]
reading_time: 2
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortinet Confirms Active FortiCloud SSO Bypass on Fully Patched FortiGate Firewalls

**[The Hacker News](https://daily.dev/sources/thn)** · 2 min read · 0 upvotes · 0 comments

## Summary

Fortinet confirmed active exploitation of a FortiCloud SSO authentication bypass affecting fully patched FortiGate firewalls. The new attack path bypasses previous patches for CVE-2025-59718 and CVE-2025-59719 through crafted SAML messages. Attackers create persistence accounts (cloud-noc@mail.io, cloud-init@mail.io), grant VPN access, and exfiltrate firewall configurations. Fortinet recommends restricting administrative access via local-in policies and disabling FortiCloud SSO logins, noting the issue affects all SAML SSO implementations.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://thehackernews.com/2026/01/fortinet-confirms-active-forticloud-sso.html>

## Similar posts on daily.dev

- [Fortinet SSO patch bypass gets a separate critical CVE](https://daily.dev/posts/fortinet-sso-patch-bypass-gets-a-separate-critical-cve-pbbljiqf4) · The Register · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#authentication](https://daily.dev/tags/authentication), [#fortinet](https://daily.dev/tags/fortinet)

[View this post on daily.dev](https://daily.dev/posts/fortinet-confirms-active-forticloud-sso-bypass-on-fully-patched-fortigate-firewalls-b0r3dojod)