FortiOS 7.6.8 breaks admin SAML SSO (bug 1338764)

Call: Known issue. Upgrade anyway. 7.6.8 is the 7.6 build in Fortinet’s October hardening release, which fixes critical and high-severity bugs, so staying on 7.6.7 isn’t the safe option. Just don’t let SSO be the only way into the box when you do it.

What breaks: Admin GUI logins that use SAML. The redirect lands on /error/saml with “Single Sign-On Failed”. The crashlog shows a “FORTISM Violation” on /tmp/ftnt1_sp_metadata.xml. Fortinet confirms it in the 7.6.8 release notes and in a staff article (Oct 23). The fix is scheduled for 7.6.9, with no date.

Who’s hit: FortiOS 7.6.8 only.

Broken: FortiCloud SSO for admins, admin SAML with a third-party IdP (Entra ID, for example), and Security Fabric SAML SSO to downstream FortiGates.
Fine: VPN user SSO; local, RADIUS, LDAP and TACACS+ admins; and FortiOS 7.2.14, 7.4.13, 7.6.7 and 8.0.2.

Workaround:

Before you upgrade: create a local, RADIUS, LDAP or TACACS+ admin account and test that it actually logs in.
If you’ve already upgraded and SSO was all you had: recover from the console, or add an admin through FortiManager or FortiManager Cloud.
One community user reports that config system saml / set default-login-page normal brings back the local login page. That’s a single report, not confirmed by Fortinet.

Also on 7.6.8’s known-issues list: 1353422 (1800F/1801F drop traffic on SFP ports), 1353040 (370xF/480xF interfaces stay down) and 1353401 (ARP announcements dropped on virtual-wire-pair members). Check the list against your hardware before the change window, not during it.

Sources: 7.6.8 known issues (opens in a new tab), Fabric SAML SSO note (opens in a new tab), Fortinet staff article (opens in a new tab), Fortinet community thread (opens in a new tab).

FortiOS 7.6.8 breaks admin SAML SSO (bug 1338764)

Sources

More from October 2026 patch cycle