Hackers breach Fortinet FortiGate devices, steal firewall configs

Fortinet FortiGate devices are under attack from hackers who are creating rogue accounts and stealing firewall configuration data. The attacks began on January 15, exploiting an unknown vulnerability in the devices' single sign-on (SSO) feature. Arctic Wolf, a cybersecurity company, reported that the attacks are similar to incidents documented in December 2025. It is not yet known if the latest attacks are covered by the patch for CVE-2025-59718 and CVE-2025-59719. Fortinet is planning to release new FortiOS versions to address the security flaw.