Fortinet Disables FortiCloud SSO Following 0-day Vulnerability Exploited in the Wild

Fortinet confirmed active exploitation of a zero-day authentication bypass (FG-IR-26-060) that lets attackers using malicious FortiCloud accounts log into and gain administrative access to devices (FortiOS, FortiManager, FortiAnalyzer) with FortiCloud SSO enabled; Fortinet temporarily disabled FortiCloud SSO, released fixed versions across multiple branches, published IoCs (SSO accounts, IPs, malicious local admin names), and provided mitigation guidance including disabling FortiCloud SSO and restricting admin access.