Critical FortiGate SSO Flaw Under Active Exploitation: Attackers Bypass Auth and Exfiltrate Configs

A critical Fortinet FortiGate SSO flaw is being actively exploited, with attackers bypassing authentication to log in as administrators via Single Sign-On and exfiltrate configurations, according to Arctic Wolf. The attacks, beginning on 12 December 2025, target CVE-2025-59718 and CVE-2025-59719, both rated at a critical CVSS of 9.1, and allow unauthenticated bypass of SSO login protections through crafted SAML messages.

Arctic Wolf notes a dangerous onboarding caveat: when administrators register devices via FortiCare through the GUI, FortiCloud SSO is enabled unless the “Allow administrative login using FortiCloud SSO” setting on the registration page is disabled, effectively arming the vulnerability in real deployments.

Intrusion activity shows logins from specific hosting providers such as The Constant Company LLC, Bl Networks, and Kaopu Cloud Hk Limited, with attackers exporting configurations to the same IP addresses via the GUI after gaining admin access. Fortinet’s advisory recommends upgrading to fixed FortiOS versions (7.6.4, 7.4.9, 7.2.12, or 7.0.18) and, for those unable to patch immediately, disabling the vulnerable feature via CLI: config system globalset admin-forticloud-sso-login disableend.