# FortiGate SSO Authentication Bypass Campaign (CVE-2025-59718, CVE-2025-59719, CVE-2026-24858)

> Active exploitation campaign chaining three critical FortiGate SSO authentication bypass vulnerabilities to gain unauthenticated admin access to FortiGate firewalls, extract device configurations containing LDAP/AD credentials, enroll rogue workstations in Active Directory, and deploy RMM tools (Pulseway, MeshAgent) for persistent access. Campaign observed from November 2025 through February 2026 across multiple organizations, with NTDS.dit exfiltration confirming full domain compromise.

- **Published:** 2026-03-10T12:00:00Z
- **Last reviewed:** 2026-07-18T21:52:17.206Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0205
- **ID:** TL-2026-0205
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-59718, CVE-2025-59719, CVE-2026-24858

## Description

An ongoing exploitation campaign targets Fortinet FortiGate next-generation firewall appliances through a chain of three critical SSO authentication bypass vulnerabilities. The campaign leverages CVE-2025-59718 and CVE-2025-59719 (CVSS 9.1, CWE-347 — Improper Verification of Cryptographic Signature) disclosed December 2025, and CVE-2026-24858 (CVSS 9.8, CWE-288 — Authentication Bypass Using an Alternate Path or Channel) disclosed January 2026.

CVE-2025-59718 affects FortiOS, FortiProxy, and FortiSwitchManager, while CVE-2025-59719 affects FortiWeb. Both vulnerabilities allow unauthenticated attackers to bypass FortiCloud Single Sign-On (SSO) authentication by submitting specially crafted SAML messages, granting administrative access without valid credentials. The FortiCloud SSO feature, while disabled by factory default, is automatically enabled when devices are registered to FortiCare via the GUI unless explicitly opted out, significantly expanding the attack surface across registered deployments.

CVE-2026-24858 is a net-new vulnerability (not a patch bypass) that allows attackers with a FortiCloud account and a registered device to authenticate to devices registered under other accounts. Organizations that fully patched CVE-2025-59718/59719 remained vulnerable to CVE-2026-24858. Shadowserver identified nearly 10,000 Fortinet instances with FortiCloud SSO enabled globally, with approximately 25% located in the United States.

SentinelOne documented two detailed intrusion incidents spanning November 2025 through February 2026:

Incident 1 (November 2025 – February 2026): Attackers exploited the SSO bypass to extract FortiGate configurations via the 'show full-configuration' command, decrypting reversible encryption to harvest embedded LDAP service account credentials (notably the 'fortidcagent' account). They created a local admin account named 'support' with four firewall policies enabling all-zone traversal. Using the compromised service account, attackers exploited the default Active Directory mS-DS-MachineAccountQuota attribute (which allows standard users to join up to 10 workstations) to enroll rogue workstations (WIN-X8WRBOSK0OF, WIN-YRSXLEONJY2, WIN-1J7L3SQSTMS) into the domain. Network reconnaissance was conducted using SoftPerfect Network Scanner, and password spraying attacks were launched from the FortiGate IP itself.

Incident 2 (Late January 2026): Within 10 minutes of creating a backdoor account 'ssl-admin', attackers logged into multiple servers using Domain Administrator credentials via Network (Type 3) and RDP (Type 10) sessions. They deployed Pulseway and MeshAgent RMM tools for persistence, hiding MeshAgent via registry modification (SystemComponent=1) and creating scheduled tasks (JavaMainUpdate for Pulseway, MeshUserTask for MeshAgent). DLL side-loading was performed via spoofed Java executable names. The attackers extracted NTDS.dit and SYSTEM registry hive via Volume Shadow Copy (WMIC), compressed with makecab, and exfiltrated within an 8-minute window before deleting artifacts.

C2 infrastructure included domains ndibstersoft.com and neremedysoft.com, with Cloudflare-hosted callback at 172.67.196.232:443. Payloads were staged via AWS S3 (fastdlvrss.s3.us-east-1.amazonaws.com) and Google Cloud Storage.

---

**Revalidated on 2026-03-12**

UPDATE (2026-03-12 Revalidation): The campaign has significantly escalated beyond the two SentinelOne-documented incidents. Between January 11 and February 18, 2026, a Russian-speaking, financially motivated threat actor used CyberStrikeAI — an open-source AI-native offensive security platform written in Go — to automate mass scanning and exploitation of FortiGate appliances, compromising 600+ devices across 55 countries in approximately five weeks. CyberStrikeAI was built by a Chinese developer (alias Ed1s0nZ) with documented ties to China's CNNVD (operated by CNITSEC under MSS oversight), evidenced by a CNNVD 2024 Vulnerability Reward Program Level 2 award that was subsequently scrubbed from the developer's GitHub profile. The platform integrates 100+ security tools with AI orchestration enabling end-to-end automation from conversational commands through vulnerability discovery and attack-chain execution. Between January 20 and February 26, 2026, researchers observed 21 unique CyberStrikeAI server IPs clustered across China (9 — Tencent, Alibaba, Huawei Cloud, China Telecom), Singapore (5), the US (3), and Hong Kong/Japan/Switzerland. Additional malicious FortiCloud accounts have been identified: heltaylor.12@tutamail.com and support@openmail.pro. The campaign pattern is consistent with initial access broker (IAB) operations. Targeted sectors now explicitly confirmed as healthcare, government agencies, and managed service providers (MSPs).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1136 Create Account
- T1098 Account Manipulation
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1112 Modify Registry
- T1036 Masquerading
- T1070 Indicator Removal
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1110 Brute Force
- T1046 Network Service Discovery
- T1087 Account Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1601 Modify System Image
- T1600 Weaken Encryption
- T1486 Data Encrypted for Impact

## Sources

- [SentinelOne — FortiGate Edge Intrusions: Stolen Service Accounts Lead to Rogue Workstations and Deep AD Compromise](https://www.sentinelone.com/blog/fortigate-edge-intrusions/)
- [Fortinet PSIRT Blog — Analysis of Single Sign-On Abuse on FortiOS](https://www.fortinet.com/blog/psirt-blogs/analysis-of-sso-abuse-on-fortios)
- [Fortinet Advisory FG-IR-25-647 — FortiCloud SSO Auth Bypass (CVE-2025-59718/59719)](https://fortiguard.fortinet.com/psirt/FG-IR-25-647)
- [Fortinet Advisory FG-IR-26-060 — Administrative FortiCloud SSO Authentication Bypass (CVE-2026-24858)](https://www.fortiguard.com/psirt/FG-IR-26-060)
- [CISA Alert — Fortinet Releases Guidance to Address CVE-2026-24858](https://www.cisa.gov/news-events/alerts/2026/01/28/fortinet-releases-guidance-address-ongoing-exploitation-authentication-bypass-vulnerability-cve-2026)
- [Rapid7 — Critical Vulnerabilities in Fortinet CVE-2025-59718, CVE-2025-59719 Exploited in the Wild](https://www.rapid7.com/blog/post/etr-critical-vulnerabilities-in-fortinet-cve-2025-59718-cve-2025-59719-exploited-in-the-wild/)
- [Arctic Wolf — CVE-2025-59718 and CVE-2025-59719: FortiCloud SSO Login Authentication Bypass](https://arcticwolf.com/resources/blog/cve-2025-59718-and-cve-2025-59719/)
- [Arctic Wolf — Malicious SSO Logins on FortiGate Devices Following CVE-2025-59718/59719 Disclosure](https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/)
- [Canadian Centre for Cyber Security — AL25-019: FortiCloud SSO Login Authentication Bypass](https://www.cyber.gc.ca/en/alerts-advisories/al25-019-vulnerabilities-impacting-fortinet-products-forticloud-sso-login-authentication-bypass-cve-2025-59718-cve-2025-59719)
- [CyberScoop — Fortinet Zero-Day CVE-2026-24858](https://cyberscoop.com/ortinet-zero-day-cve-2026-24858-forticloud-sso-auth-bypass/)
- [Kudelski Security — FortiCloud SSO Authentication Bypass Vulnerabilities Actively Exploited](https://kudelskisecurity.com/research/fortinet-forticloud-sso-authentication-bypass-vulnerabilities-actively-exploited-cve-2025-59718-cve-2025-59719)
- [SOC Prime — CVE-2026-24858: FortiOS SSO Zero-Day Exploited in the Wild](https://socprime.com/blog/cve-2026-24858-vulnerability/)
- [Qualys ThreatPROTECT — Fortinet Critical Vulnerabilities CVE-2025-59718 & CVE-2025-59719](https://threatprotect.qualys.com/2025/12/10/fortinet-addresses-critical-vulnerabilities-impacting-multiple-fortinet-products-cve-2025-59718-cve-2025-59719/)
- [SOCRadar — CVE-2026-24858: Patch Released for Fortinet FortiOS SSO Authentication Bypass](https://socradar.io/blog/cve-2026-24858-fortinet-fortios-sso-patch/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0205