FORTINET ADMITS FORTIGATE SSO BUG STILL EXPLOITABLE DESPITE DECEMBER PATCH

Summary from the TLDR InfoSec newsletter

Attackers can still exploit a critical FortiCloud SSO authentication vulnerability in FortiOS, even on systems fully patched in December, by abusing a new SAML-based SSO attack path. Recent campaigns involve automated reconfiguration of FortiGate firewalls, the creation of backdoor admin accounts, and the theft of configuration files. Fortinet has urged customers to monitor authentication logs, restrict management exposure, and track admin changes while it develops a new fix.