“New” Path of Attack: Fully Upgraded Fortinet Devices Hit by SSO Exploits

Fortinet has identified an active wave of attacks against FortiGate devices where attackers bypass FortiCloud SSO — even on devices patched for prior CVEs — to gain access, create local administrative backdoors (e.g., accounts named audit, backup, itadmin), and obfuscate origination via Cloudflare-protected IPs (examples: 104.28.244.115, 104.28.212.114). Fortinet recommends disabling FortiCloud SSO if not required, restricting admin access to trusted IPs, and applying CLI mitigation (set admin-forticloud-sso-login disable) while a new patch is developed.