FortiGate FortiCloud SSO bypass exploitation

Attackers are exploiting **FortiGate** appliances through **CVE-2025-59718** and **CVE-2025-59719** after Fortinet disclosed fixes for the authentication-bypass flaws. The abuse uses crafted **SAML** messages against **FortiCloud SSO** when it is enabled, and malicious logins have been seen on the **admin** account. Observed source IPs were associated with hosting providers including **The Constant Company llc**, **Bl Networks**, and **Kaopu Cloud Hk Limited**. After access is gained, the attackers export device configuration through the web interface, which can expose credentials, network details, and firewall policy data. Fortinet released updates for **FortiOS**, **FortiWeb**, **FortiProxy**, and **FortiSwitchManager** and advised administrators to disable **FortiCloud SSO** until systems are upgraded. The same flaws were added to **CISA**'s actively exploited list, with a **December 23** deadline for U.S. government agencies under **BOD 22-01**. Shadowserver reported more than **25,000** exposed Fortinet devices with a FortiCloud SSO fingerprint, including over **5,400** in the United States and nearly **2,000** in India, but available evidence does not show how many of those devices have been secured.