Fortinet FortiGate Under Active Attack Through SAML SSO Authentication Bypass

Threat actors are exploiting two newly disclosed authentication bypasses in Fortinet FortiGate devices, CVE-2025-59718 and CVE-2025-59719 (CVSS scores: 9.8), in active intrusions involving malicious single sign-on logins, according to Arctic Wolf Labs. Arctic Wolf said it observed these intrusions on FortiGate appliances on 12 December 2025, with patches for FortiOS, FortiWeb, FortiProxy and FortiSwitchManager released by Fortinet last week.

The vulnerabilities allow unauthenticated bypass of SSO login authentication via crafted SAML messages if FortiCloud SSO is enabled on affected devices, though FortiCloud SSO is disabled by default and can be automatically enabled during FortiCare registration unless administrators disable it.

In Arctic Wolf’s malicious activity observations, a limited set of hosting providers, including The Constant Company llc, Bl Networks, and Kaopu Cloud Hk Limited, were used to carry out the malicious SSO logins against the “admin” account, after which device configurations were exported via the GUI to the same IP addresses.

The advisory urged organisations to apply patches urgently and to disable FortiCloud SSO until updates are in place, while limiting management interface access to trusted internal users; analysts also note that threat actors may crack hashes offline if credentials are weak, recommending organisations to reset hashed firewall credentials stored in exfiltrated configurations if IoCs are found.