Fortinet Warns of Critical Flaws Allowing Authentication Bypass
Fortinet Warns of Critical Flaws Allowing Authentication Bypass#### Welcome to another episode of Security Sunday! This week, we look at critical Fortinet vulnerabilities that allow attackers to bypass FortiCloud SSO and log in as admin without credentials. We also cover GeminiJack, a zero-click attack on Google Gemini Enterprise. NANOREMOTE, a Chinese backdoor hiding C2 traffic inside Google Drive, and a new Outlook RCE vulnerability. Let’s dive in.
Fortinet has released security updates for two critical vulnerabilities affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager products. Attackers can exploit these flaws to bypass FortiCloud SSO authentication and gain administrative access to devices.
These are Improper Verification of Cryptographic Signature (CWE-347) vulnerabilities that allow a remote unauthenticated attacker to bypass the FortiCloud SSO login mechanism.
The issue lies in insufficient verification of cryptographic signatures in SAML messages. An attacker can craft a malicious SAML message that passes validation even though it is not legitimately signed. The result is the ability to log into the administrative interface without knowing any credentials.
Fortinet notes that the FortiCloud SSO login feature is not enabled by default in factory settings. However, when an administrator registers a device to FortiCare via the GUI and does not explicitly disable the “Allow administrative login using FortiCloud SSO” toggle, this feature is automatically enabled. In other words, if you have ever registered a FortiGate or other Fortinet device to FortiCare through the web interface and did not pay attention to individual checkboxes, you probably have this feature enabled.
The fix is simple: update to the latest version of FortiOS, FortiProxy, FortiSwitchManager, and FortiWeb.
GeminiJack: Zero-Click Vulnerability in Google Gemini
Security researchers from Noma Labs have discovered a critical vulnerability in Google Gemini Enterprise, which they named GeminiJack. This zero-click vulnerability allowed attackers to gain access to sensitive corporate data in Gmail, Google Calendar, and Google Docs — without any interaction from the victim.
This was not a classic software bug, but an architectural weakness in how enterprise AI systems interpret information. Traditional security tools such as DLP (Data Loss Prevention) or endpoint protection did not detect the attack at all.
GeminiJack exploited a technique known as indirect prompt injection. The attacker did not need direct access to the victim’s system — sharing a seemingly harmless document was enough.
Google collaborated with the researchers to validate the findings and deployed updates that changed how Gemini Enterprise and Vertex AI Search interact with their systems.
NANOREMOTE: New Backdoor Abuses Google Drive to Control Windows
Security researchers from Elastic Security Labs have discovered a new fully-featured Windows backdoor called NANOREMOTE, which uses the Google Drive API for command-and-control (C2) communication. This malware poses a serious threat primarily due to its ability to blend in with normal network traffic.
NANOREMOTE shares a codebase with the previously discovered implant FINALDRAFT (also known as Squidoor), which uses Microsoft Graph API for the same purposes. Both tools are attributed to a Chinese espionage group tracked under various names: REF7707, CL-STA-0049, Earth Alux, or Jewelbug.
This group has been active since at least March 2023 and targets government institutions, the defense sector, telecommunications, education, and the aerospace industry.
The attack chain consists of two main components: the WMLOADER loader and the NANOREMOTE payload.
WMLOADER masquerades as a legitimate Bitdefender security program (BDReinit.exe) with an invalid digital signature. Upon execution, the program makes numerous Windows function calls (VirtualAlloc / VirtualProtect) and prepares the process to host shellcode stored within the file.
The shellcode is decrypted using a rolling XOR algorithm and then searches for the wmsetup.log file in the same folder. This file is then decrypted using AES-CBC with a 16-byte key (3A5AD78097D944AC) and launches the NANOREMOTE backdoor directly in memory.
The discovery of NANOREMOTE highlights the continuing trend of abusing legitimate cloud services for cyber espionage.
Critical Microsoft Outlook Vulnerability Allows Remote Code Execution
Microsoft, as part of December’s Patch Tuesday (December 9, 2025), released a fix for a severe vulnerability in Microsoft Outlook. The vulnerability tracked as CVE-2025–62562 falls into the Remote Code Execution (RCE) category and allows attackers to execute arbitrary malicious code on the victim’s system.
The discovery was made by security researcher Haifei Li from EXPMON.
Technically, this is a Use-After-Free (UAF) vulnerability. This class of bugs occurs when a program continues to use memory after it has been freed. As a result, application crashes, system instability, or — as in this case — execution of arbitrary attacker code can occur.
Unlike many other RCE vulnerabilities in Office products, the Preview Pane is NOT an attack vector. For successful exploitation, the attacker must send the victim a specially crafted email and convince the user to reply to it — the chain leading to malicious code execution is triggered precisely when replying.
The requirement for user interaction does add a layer of protection, but combined with social engineering, this vulnerability remains a real threat. Attackers can create convincing emails that prompt users to reply.
CVE-2025–62562 is part of a larger December update package. Microsoft fixed a total of 56 new vulnerabilities in December, including 3 critical ones. Overall, Microsoft fixed 1,139 vulnerabilities in 2025, which is the second-highest count in history.