Fortinet confirms critical FortiCloud auth bypass not fully patched

Days after admins began reporting that their fully patched firewalls are being hacked, Fortinet confirmed it's working to fully address a critical FortiCloud SSO authentication bypass vulnerability that should have already been patched since early December. This comes after a wave of reports from Fortinet customers about threat actors exploiting a patch bypass for the CVE-2025-59718 vulnerability to compromise fully patched firewalls. Cybersecurity company Arctic Wolf said on Wednesday that the campaign began on January 15, with attackers creating accounts with VPN access and stealing firewall configurations within seconds, in what appear to be automated attacks. It also added that the attacks are very similar to incidents it documented in December, following the disclosure of the CVE-2025-59718 critical vulnerability in Fortinet products. On Thursday, Fortinet finally confirmed these reports, stating that ongoing CVE-2025-59718 attacks match December's malicious activity and that it's now working to fully patch the flaw. Affected Fortinet customers have also shared logs showing that the attackers created admin users after an SSO login from cloud-init@mail.io on IP address 104.28.244.114, which match indicators of compromise detected by Arctic Wolf while analyzing ongoing FortiGate attacks and December in-the-wild exploitation, as well as those shared by Fortinet on Thursday. "Recently, a small number of customers reported unexpected login activity occurring on their devices...