Beginning in mid-January 2026, security researchers observed a sustained and likely automated exploitation campaign targeting FortiGate firewalls via FortiCloud SSO, characterized by unauthorized administrative logins, rapid configuration exports, and the creation of generic super-admin accounts for persistence. The campaign closely aligns with exploitation of the critical FortiCloud SSO authentication bypass vulnerability tracked as CVE-2025-59718 (and the related CVE-2025-59719), originally disclosed in December 2025, with attackers leveraging crafted SAML messages to bypass authentication when SSO is enabled. Notably, follow-on reporting indicates the vulnerability can still be exploited on systems running FortiOS 7.4.9 and 7.4.10, suggesting a patch bypass or incomplete remediation, a finding reportedly acknowledged internally by Fortinet, which is planning additional FortiOS releases to fully resolve the issue. Observed intrusions consistently show malicious SSO logins (often using accounts such as “cloud-init@mail.io”) followed within seconds by configuration downloads and the creation of new administrator users, strongly indicating automation. In response, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-59718 to its Known Exploited Vulnerabilities (KEV) catalog, while Shadowserver continues to track thousands of internet-exposed Fortinet devices with FortiCloud SSO enabled. Until a fully effective patch is released, CTIX analysts urge administrators and defenders to disable FortiCloud SSO where possible, restrict management interface access, monitor for suspicious SSO logins and rapid admin changes, and reset credentials on any potentially affected devices.