Fortinet admits FortiGate SSO bug still exploitable despite December patch

Fortinet has confirmed attackers are actively abusing a SAML-based FortiCloud SSO authentication bypass—including against systems reportedly patched in December—allowing rapid, automated reconfiguration of FortiGate devices, creation of backdoor admin users, and exfiltration of configuration files. Fortinet is investigating a new attack path, warns the issue affects SAML SSO broadly, and advises customers to monitor authentication logs, restrict management interfaces, and watch for unexpected administrative changes while a remedial fix is developed.