Fortinet Firewalls Hit With Malicious Configuration Changes

Arctic Wolf Labs observed a campaign beginning Jan. 15 where threat actors abused FortiCloud SSO to log into FortiGate devices, create accounts, grant VPN access, and quickly exfiltrate firewall configurations; the activity appears automated and may bypass previously released patches for CVE-2025-59718 and CVE-2025-59719, and Fortinet has acknowledged incomplete mitigation and is preparing a new fix.