Arctic Wolf sees unauthorised FortiGate configuration changes via SSO

Arctic Wolf has reported renewed malicious activity against Fortinet FortiGate devices from 15 January 2026, involving unauthorised configuration changes via SSO accounts. The activity includes creation of generic user accounts, configuration changes granting VPN access, and exfiltration of firewall configurations. Similar reports have been shared by multiple Reddit users, including incidents affecting fully patched FortiOS devices. The behaviour resembles exploitation of CVE-2025-59718 and CVE-2025-59719, though reports of activity on FortiOS 7.4.10 suggest patching alone may be insufficient. Fortinet recommends temporarily disabling SSO logins while investigation and mitigation continue.

What this means for your organisation

The firewall is one of the few components where a compromise gives the attacker both access and an overview. An exfiltrated configuration is a map of your entire network: segments, rules, VPN setup and naming conventions. That the activity is also seen on patched devices is what makes this difficult, because the usual answer of applying updates offers no guarantee. You have to go looking for traces rather than assume you are outside it.

Berigo recommends

• Consider temporarily disabling SSO logins on FortiGate, in line with Fortinet's advice.
• Review user accounts and VPN configuration on your firewalls and remove anything not documented as created.
• Treat the firewall configuration as potentially exposed: rotate shared secrets and reassess segmentation.
• Set up alerting on firewall configuration changes so the next one is detected the same day.

Source

• arcticwolf.com
• fortiguard.fortinet.com
• reddit.com