FortiOS super_admin websocket session tied to unauthorized forticloud-sync creation

Duo Tech@duotech

•updated Aug 10, 2026•5•0•10

Detects creation of the malicious persistent 'forticloud-sync' super-user account on FortiOS following an anomalous admin WebSocket session, consistent with post-exploitation of CVE-2024-55591/CVE-2025-24472.