Fortinet Warns of Active Exploitation Bypassing FortiCloud SSO Authentication

Fortinet Confirms Active Exploitation of FortiCloud SSO Authentication Bypass

Fortinet has confirmed that threat actors are actively exploiting a vulnerability in its FortiCloud single sign-on (SSO) authentication system, allowing attackers to bypass authentication controls—even on devices that have received security patches.

The company issued the warning following reports of ongoing attacks targeting the FortiCloud SSO login mechanism. While Fortinet has not yet disclosed specific technical details about the vulnerability, the exploitation appears to mirror recent authentication bypass flaws in Fortinet products.

Technical Details and Attack Vector

At this time, Fortinet has not released a CVE identifier for the vulnerability. However, security researchers note that the attack vector resembles previously disclosed FortiCloud SSO flaws, which often involve:

• Manipulation of authentication tokens or session handling mechanisms
• Exploitation of improper input validation in SSO login requests
• Bypassing multi-factor authentication (MFA) protections

The fact that patched devices remain vulnerable suggests either:

1. A new, unpatched vulnerability in the SSO implementation, or
2. Attackers leveraging misconfigurations or residual weaknesses in previously mitigated flaws.

Impact Analysis

Successful exploitation of this vulnerability could allow unauthenticated attackers to:

• Gain unauthorized access to Fortinet management interfaces
• Escalate privileges within the FortiCloud environment
• Move laterally across connected Fortinet devices and services
• Exfiltrate sensitive data or deploy additional malicious payloads

Given Fortinet’s widespread use in enterprise and government networks, this vulnerability poses a significant risk to organizations relying on FortiCloud for centralized authentication and device management.

Mitigation and Recommendations

Fortinet has not yet released an official patch or advisory for this specific vulnerability. However, security teams are advised to:

1. Monitor Fortinet’s PSIRT advisories for updates and official guidance (Fortinet PSIRT).
2. Review FortiCloud access logs for suspicious authentication attempts or anomalous activity.
3. Enforce strict network segmentation to limit lateral movement in case of a breach.
4. Implement additional authentication controls, such as IP whitelisting or conditional access policies, for FortiCloud SSO.
5. Consider temporarily disabling FortiCloud SSO if feasible, and enforce manual authentication until a patch is available.

SecurityWeek will continue to monitor this developing situation and provide updates as more technical details emerge.

---

Original reporting by Ionut Arghire for SecurityWeek.