Fortinet admins report patched FortiGate firewalls getting hacked

Fortinet customers are reporting active exploitation of a FortiCloud SSO authentication bypass (CVE-2025-59718) that appears not fully mitigated in some FortiOS releases (notably 7.4.9 and reportedly 7.4.10), with attackers using crafted SAML messages to create admin accounts; Shadowserver found thousands of devices with FortiCloud SSO enabled and CISA has added the CVE to its known exploited vulnerabilities list, while Fortinet plans additional patches and administrators are advised to disable FortiCloud SSO until fixes are confirmed.