Automated FortiGate Attacks Exploit FortiCloud SSO to Alter Firewall Configurations

Arctic Wolf has identified automated attacks targeting Fortinet FortiGate devices starting January 15, 2026, exploiting FortiCloud SSO vulnerabilities (CVE-2025-59718 and CVE-2025-59719) to bypass authentication. Attackers create persistence accounts like 'secadmin' and 'itadmin', modify firewall configurations to grant VPN Show more