FortiGate FortiCloud SSO bypass exploitation

**FortiGate** appliances are in an active exploitation wave after attackers began abusing **CVE-2025-59718** and **CVE-2025-59719** less than a week after disclosure. **Arctic Wolf** observed malicious **SSO logins** on **December 12, 2025**, and the activity quickly escalated to **device configuration exports**. The live abuse matters because successful authentication bypass can expose administrative access and sensitive firewall settings.

**Fortinet** patched **FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager** on **December 9** for **CVE-2025-59718** and **CVE-2025-59719**, critical flaws that can bypass **FortiCloud SSO authentication** through a **maliciously crafted SAML message**. The company said the vulnerable **FortiCloud SSO login feature** is not enabled by default on devices that are not **FortiCare-registered**, and administrators were told to **disable FortiCloud SSO login** until they can upgrade to a **non-vulnerable version**. The incident later moved into active exploitation, with attackers abusing the flaws against Fortinet devices that have **FortiCloud SSO** enabled to gain **admin-level access** to the web management interface and download **system configuration files**. **Shadowserver** said it found **over 25,000 Fortinet devices** exposed online with **FortiCloud SSO** enabled, and **CISA** added the issue to its catalog of **actively exploited** vulnerabilities with a **December 23** patch deadline for **U.S. government agencies**.