Fortinet Confirms Active FortiCloud SSO Bypass on Fully Patched FortiGate Firewalls

Fortinet confirmed active exploitation of a FortiCloud SSO authentication bypass affecting fully patched FortiGate firewalls. The new attack path bypasses previous patches for CVE-2025-59718 and CVE-2025-59719 through crafted SAML messages. Attackers create persistence accounts (cloud-noc@mail.io, cloud-init@mail.io), grant VPN access, and exfiltrate firewall configurations. Fortinet recommends restricting administrative access via local-in policies and disabling FortiCloud SSO logins, noting the issue affects all SAML SSO implementations.