FortiGate SSO Authentication Bypass Campaign (CVE-2025-59718, CVE-2025-59719, CVE-2026-24858)
FortiGate SSO Authentication Bypass Campaign (TL-2026-0205), also tracked as FortiCloud SSO Bypass Campaign, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-03-10 and last reviewed 2026-07-18. It has no confirmed attribution, affects Fortinet FortiOS, references 3 CVEs (CVE-2025-59718, CVE-2025-59719, CVE-2026-24858), maps to 26 MITRE ATT&CK techniques (T1003, T1005, T1021), and is covered by 9 detection rules and 31 indicators of compromise.
Key facts for TL-2026-0205
- Threat ID
- TL-2026-0205
- Also known as
- FortiCloud SSO Bypass Campaign, FortiGate Edge Intrusions
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-03-10
- Last reviewed
- 2026-07-18
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- government, financial, healthcare, technology, critical-infrastructure, defense, education, energy
- Target regions
- North America, Europe, Asia-Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 31
- Updates
- 2026-07-18 · revalidated 1× · latest source
Malware and tooling in FortiGate SSO Authentication Bypass Campaign
Malware and tooling: MeshAgent, Pulseway, SoftPerfect Network Scanner
Active exploitation campaign chaining three critical FortiGate SSO authentication bypass vulnerabilities to gain unauthenticated admin access to FortiGate firewalls, extract device configurations containing LDAP/AD credentials, enroll rogue workstations in Active Directory, and deploy RMM tools (Pulseway, MeshAgent) for persistent access. Campaign observed from November 2025 through February 2026 across multiple organizations, with NTDS.dit exfiltration confirming full domain compromise.
How FortiGate SSO Authentication Bypass Campaign works
An ongoing exploitation campaign targets Fortinet FortiGate next-generation firewall appliances through a chain of three critical SSO authentication bypass vulnerabilities. The campaign leverages CVE-2025-59718 and CVE-2025-59719 (CVSS 9.1, CWE-347 — Improper Verification of Cryptographic Signature) disclosed December 2025, and CVE-2026-24858 (CVSS 9.8, CWE-288 — Authentication Bypass Using an Alternate Path or Channel) disclosed January 2026.
CVE-2025-59718 affects FortiOS, FortiProxy, and FortiSwitchManager, while CVE-2025-59719 affects FortiWeb. Both vulnerabilities allow unauthenticated attackers to bypass FortiCloud Single Sign-On (SSO) authentication by submitting specially crafted SAML messages, granting administrative access without valid credentials. The FortiCloud SSO feature, while disabled by factory default, is automatically enabled when devices are registered to FortiCare via the GUI unless explicitly opted out, significantly expanding the attack surface across registered deployments.
CVE-2026-24858 is a net-new vulnerability (not a patch bypass) that allows attackers with a FortiCloud account and a registered device to authenticate to devices registered under other accounts. Organizations that fully patched CVE-2025-59718/59719 remained vulnerable to CVE-2026-24858. Shadowserver identified nearly 10,000 Fortinet instances with FortiCloud SSO enabled globally, with approximately 25% located in the United States.
SentinelOne documented two detailed intrusion incidents spanning November 2025 through February 2026:
Incident 1 (November 2025 – February 2026): Attackers exploited the SSO bypass to extract FortiGate configurations via the 'show full-configuration' command, decrypting reversible encryption to harvest embedded LDAP service account credentials (notably the 'fortidcagent' account). They created a local admin account named 'support' with four firewall policies enabling all-zone traversal. Using the compromised service account, attackers exploited the default Active Directory mS-DS-MachineAccountQuota attribute (which allows standard users to join up to 10 workstations) to enroll rogue workstations (WIN-X8WRBOSK0OF, WIN-YRSXLEONJY2, WIN-1J7L3SQSTMS) into the domain. Network reconnaissance was conducted using SoftPerfect Network Scanner, and password spraying attacks were launched from the FortiGate IP itself.
Incident 2 (Late January 2026): Within 10 minutes of creating a backdoor account 'ssl-admin', attackers logged into multiple servers using Domain Administrator credentials via Network (Type 3) and RDP (Type 10) sessions. They deployed Pulseway and MeshAgent RMM tools for persistence, hiding MeshAgent via registry modification (SystemComponent=1) and creating scheduled tasks (JavaMainUpdate for Pulseway, MeshUserTask for MeshAgent). DLL side-loading was performed via spoofed Java executable names. The attackers extracted NTDS.dit and SYSTEM registry hive via Volume Shadow Copy (WMIC), compressed with makecab, and exfiltrated within an 8-minute window before deleting artifacts.
C2 infrastructure included domains ndibstersoft.com and neremedysoft.com, with Cloudflare-hosted callback at 172.67.196.232:443. Payloads were staged via AWS S3 (fastdlvrss.s3.us-east-1.amazonaws.com) and Google Cloud Storage.
---
**Revalidated on 2026-03-12**
UPDATE (2026-03-12 Revalidation): The campaign has significantly escalated beyond the two SentinelOne-documented incidents. Between January 11 and February 18, 2026, a Russian-speaking, financially motivated threat actor used CyberStrikeAI — an open-source AI-native offensive security platform written in Go — to automate mass scanning and exploitation of FortiGate appliances, compromising 600+ devices across 55 countries in approximately five weeks. CyberStrikeAI was built by a Chinese developer (alias Ed1s0nZ) with documented ties to China's CNNVD (operated by CNITSEC under MSS oversight), evidenced by a CNNVD 2024 Vulnerability Reward Program Level 2 award that was subsequently scrubbed from the developer's GitHub profile. The platform integrates 100+ security tools with AI orchestration enabling end-to-end automation from conversational commands through vulnerability discovery and attack-chain execution. Between January 20 and February 26, 2026, researchers observed 21 unique CyberStrikeAI server IPs clustered across China (9 — Tencent, Alibaba, Huawei Cloud, China Telecom), Singapore (5), the US (3), and Hong Kong/Japan/Switzerland. Additional malicious FortiCloud accounts have been identified: heltaylor.12@tutamail.com and support@openmail.pro. The campaign pattern is consistent with initial access broker (IAB) operations. Targeted sectors now explicitly confirmed as healthcare, government agencies, and managed service providers (MSPs).
MITRE ATT&CK techniques used in TL-2026-0205
credential-access
T1003 OS Credential Dumping; T1110 Brute Force; T1552 Unsecured Credentials
collection
T1005 Data from Local System; T1560 Archive Collected Data
lateral-movement
T1021 Remote Services; T1570 Lateral Tool Transfer
defense-evasion
T1036 Masquerading; T1070 Indicator Removal; T1078 Valid Accounts
exfiltration
T1041 Exfiltration Over C2 Channel
discovery
T1046 Network Service Discovery; T1087 Account Discovery
execution
T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter
persistence
T1098 Account Manipulation; T1136 Create Account
command-and-control
T1102 Web Service; T1105 Ingress Tool Transfer; T1219 Remote Access Tools
defense-impairment
T1112 Modify Registry; T1600 Weaken Encryption; T1601 Modify System Image
initial-access
T1190 Exploit Public-Facing Application
Impact
T1486 Data Encrypted for Impact
stealth
Affected products and versions in FortiGate SSO Authentication Bypass Campaign
- Fortinet — FortiOS
Vulnerable versions: 7.6.0-7.6.3; 7.4.0-7.4.8; 7.2.0-7.2.11; 7.0.0-7.0.17
Fixed in: 7.6.4+; 7.4.9+; 7.2.12+; 7.0.18+ - Fortinet — FortiProxy
Vulnerable versions: 7.6.0-7.6.3; 7.4.0-7.4.10; 7.2.0-7.2.14; 7.0.0-7.0.21
Fixed in: 7.6.4+; 7.4.11+; 7.2.15+; 7.0.22+ - Fortinet — FortiWeb
Vulnerable versions: 8.0.0; 7.6.0-7.6.4; 7.4.0-7.4.9
Fixed in: 8.0.1+; 7.6.5+; 7.4.10+ - Fortinet — FortiSwitchManager
Vulnerable versions: 7.2.0-7.2.6; 7.0.0-7.0.5
Fixed in: 7.2.7+; 7.0.6+ - Fortinet — FortiManager
Vulnerable versions: Versions with FortiCloud SSO enabled
Fixed in: Cloud-side patch deployed January 26, 2026 - Fortinet — FortiAnalyzer
Vulnerable versions: Versions with FortiCloud SSO enabled
Fixed in: Cloud-side patch deployed January 26, 2026
Remediation for FortiGate SSO Authentication Bypass Campaign
Patches
- FortiOS 7.6.4+ (from 7.6.0-7.6.3)
- FortiOS 7.4.9+ (from 7.4.0-7.4.8)
- FortiOS 7.2.12+ (from 7.2.0-7.2.11)
- FortiOS 7.0.18+ (from 7.0.0-7.0.17)
- FortiProxy 7.6.4+ (from 7.6.0-7.6.3)
- FortiProxy 7.4.11+ (from 7.4.0-7.4.10)
- FortiProxy 7.2.15+ (from 7.2.0-7.2.14)
- FortiProxy 7.0.22+ (from 7.0.0-7.0.21)
- FortiWeb 8.0.1+ (from 8.0.0)
- FortiWeb 7.6.5+ (from 7.6.0-7.6.4)
Immediate actions
- Disable FortiCloud SSO: config system global -> set admin-forticloud-sso-login disable
- Block known malicious IPs at perimeter: 185.156.73.62, 185.242.246.127, 193.24.211.61, 172.67.196.232, 45.32.153.218, 167.179.76.111, 199.247.7.82, 45.61.136.7, 38.54.88.203, 38.54.95.226, 38.60.212.97
- Block C2 domains: ndibstersoft.com, neremedysoft.com
- Audit FortiGate for unauthorized admin accounts (support, ssl-admin, audit, backup, itadmin, secadmin, remoteadmin)
- Restrict management interface access to trusted IP ranges via local-in-policy
- Check for rogue workstation enrollments in Active Directory
Workarounds
- Disable FortiCloud SSO via CLI until patches are applied
- Restrict admin access to trusted networks only
- Rotate all LDAP/AD credentials connected to FortiGate appliances
- Restore from known-clean configuration backups if compromise suspected
Longer-term hardening
- Deploy EDR with behavioral detection for RMM tool abuse (Pulseway, MeshAgent)
- Implement UEBA for impossible travel and anomalous admin login detection
- Set mS-DS-MachineAccountQuota to 0 to prevent rogue workstation enrollment
- Maintain minimum 60-90 day log retention on FortiGate appliances
- Forward all FortiGate logs to SIEM for centralized monitoring
- Implement network segmentation to limit lateral movement from edge devices
- Monitor for Volume Shadow Copy creation (NTDS.dit theft indicator)
CVEs associated with FortiGate SSO Authentication Bypass Campaign
Weaknesses (CWE) in FortiGate SSO Authentication Bypass Campaign
CWE-347, CWE-288, CWE-326, CWE-916
Timeline of FortiGate SSO Authentication Bypass Campaign
Showing the 20 most recent tracked events.
- Arctic Wolf and multiple security vendors publish advisories detailing the FortiCloud SSO authentication bypass vulnerabilities
- Active in-the-wild exploitation of CVE-2025-59718/59719 confirmed by multiple security researchers
- CISA adds CVE-2025-59718 to the Known Exploited Vulnerabilities (KEV) catalog
- GitHub proof-of-concept published; Rapid7 honeypot detects exploitation attempts; mass scanning activity observed
- CyberStrikeAI-driven mass exploitation campaign begins; Russian-speaking financially-motivated threat actor starts automated scanning and exploitation of FortiGate appliances globally [Source: The Hacker News / Amazon AWS Threat Intelligence]
- Arctic Wolf observes new automated attack cluster targeting FortiGate devices with unauthorized configuration changes, admin account creation, and VPN modifications
- First CyberStrikeAI server infrastructure observed; 21 unique IPs ultimately identified across China (9), Singapore (5), US (3), Hong Kong, Japan, and Switzerland [Source: The Hacker News / Cyberwarzone]
- CVE-2026-24858 exploitation discovered on fully-patched FortiGate devices; confirmed as net-new vulnerability separate from CVE-2025-59718/59719
- Fortinet blocks two malicious FortiCloud accounts (cloud-noc@mail.io, cloud-init@mail.io) used in CVE-2026-24858 exploitation
- Fortinet globally disables FortiCloud SSO authentication to prevent ongoing exploitation of CVE-2026-24858
- CISA adds CVE-2026-24858 to KEV catalog; Fortinet restores FortiCloud SSO with protective restrictions and issues advisory FG-IR-26-060
- CISA publishes alert urging organizations to check for compromise indicators and apply updates immediately
- Fortinet issues final patch release updates for all affected product lines; CISA federal remediation deadline set
- SentinelOne Incident 2: Attackers deploy Pulseway and MeshAgent RMM tools within 10 minutes of creating ssl-admin backdoor account; NTDS.dit exfiltrated from domain controller
- CyberStrikeAI campaign concludes initial wave; 600+ FortiGate devices compromised across 55 countries in approximately 5 weeks [Source: Field Effect / Amazon AWS]
- Cyberwarzone publishes analysis linking CyberStrikeAI to Chinese developer Ed1s0nZ with CNNVD/MSS ties; The Hacker News reports on open-source AI attack platform deployment [Source: Cyberwarzone / The Hacker News / BleepingComputer]
- Léargas Security publishes consolidated analysis confirming all three CVEs (CVE-2025-59718, CVE-2025-59719, CVE-2026-24858) actively chained for network breaches; SentinelOne publishes full campaign DFIR report [Source: Léargas Security / SentinelOne]
- SentinelOne publishes comprehensive campaign analysis documenting two intrusion incidents with full attack chain from edge exploitation to domain compromise
- As of 2026-05-29, TL-2026-0205 (FortiGate FortiCloud SSO bypass, CVE-2025-59718/59719/2026-24858) remains PATCHED: all three CVEs are fixed (FortiOS 7.4.11/7.6.6, FG-IR-25-647/26-060), in CISA KEV, with cloud-side SSO restrictions and malicious FortiCloud accounts blocked. The CyberStrikeAI exploitation wave concluded Feb 18, 2026 (600+ devices/55 countries); only retrospective DFIR reporting since, no fresh exploitation of these CVEs in Apr-May 2026.
- Truesec CSIRT publishes a post-incident analysis across multiple client engagements documenting the firmware-downgrade credential-extraction technique (using the public 'FortiGate Password Decrypt' tool) and the full attack chain from SSO bypass through stolen VPN/AD credentials to ransomware deployment on a compromised Domain Controller.
Update history for TL-2026-0205
- 2026-07-18 — Fortinet FortiCloud SSO Authentication Bypass Actively Exploited to Extract Firewall Credentials (CVE-2025-59718, CVE-2025-59719): What changed No severity/exploitability/CVSS escalation — both already CRITICAL/ACTIVE/9.8. Attribution confidence NONE → LOW and motivation UNKNOWN → FINANCIAL, evidenced by Truesec's observed ransomware-deployment endgame. New CWE-326 (In
Sources cited for FortiGate SSO Authentication Bypass Campaign
- SentinelOne — FortiGate Edge Intrusions: Stolen Service Accounts Lead to Rogue Workstations and Deep AD Compromise
- Fortinet PSIRT Blog — Analysis of Single Sign-On Abuse on FortiOS
- Fortinet Advisory FG-IR-25-647 — FortiCloud SSO Auth Bypass (CVE-2025-59718/59719)
- Fortinet Advisory FG-IR-26-060 — Administrative FortiCloud SSO Authentication Bypass (CVE-2026-24858)
- CISA Alert — Fortinet Releases Guidance to Address CVE-2026-24858
- Rapid7 — Critical Vulnerabilities in Fortinet CVE-2025-59718, CVE-2025-59719 Exploited in the Wild
- Arctic Wolf — CVE-2025-59718 and CVE-2025-59719: FortiCloud SSO Login Authentication Bypass
- Arctic Wolf — Malicious SSO Logins on FortiGate Devices Following CVE-2025-59718/59719 Disclosure
- Canadian Centre for Cyber Security — AL25-019: FortiCloud SSO Login Authentication Bypass
- CyberScoop — Fortinet Zero-Day CVE-2026-24858
- Kudelski Security — FortiCloud SSO Authentication Bypass Vulnerabilities Actively Exploited
- SOC Prime — CVE-2026-24858: FortiOS SSO Zero-Day Exploited in the Wild
- Qualys ThreatPROTECT — Fortinet Critical Vulnerabilities CVE-2025-59718 & CVE-2025-59719
- SOCRadar — CVE-2026-24858: Patch Released for Fortinet FortiOS SSO Authentication Bypass
Threats related to FortiGate SSO Authentication Bypass Campaign
- Fortinet FortiCloud SSO Cross-Tenant Authentication Bypass (CVE-2026-24858)
- FortiBleed Credential Theft Campaign Linked to INC and Lynx Ransomware Operations
- Acer Wave 7 Mesh Routers — Max-Severity Unauthenticated Zero-Days CVE-2026-49200 (Cleartext Credential Disclosure) & CVE-2026-49201 (Hardcoded AES Key Backdoor)
- Quest KACE SMA Critical Authentication Bypass Actively Exploited in Education Sector (CVE-2025-32975)
Detection coverage for TL-2026-0205
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0205 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.