Hackers are exploiting critical Fortinet flaws days after patch release

Threat actors are exploiting two critical Fortinet flaws, tracked as CVE-2025-59718 and CVE-2025-59719, days after patch release, with attacks affecting FortiOS, FortiWeb, FortiProxy and FortiSwitchManager when FortiCloud SSO is enabled, according to Arctic Wolf. The flaws, which carry a CVSS score of 9.1, allow unauthenticated bypass of FortiCloud SSO login via a crafted SAML message, prompting administrators to consider disabling FortiCloud SSO login until systems are upgraded.

Fortinet had addressed 18 vulnerabilities across FortiOS, FortiProxy, FortiSwitchManager and FortiWeb in an advisory issued after the patches, and the vendor explicitly notes that FortiCloud SSO login is not enabled by default but can become active during FortiCare registration if the toggle is left on. Arctic Wolf reports intrusions beginning on December 12, with attackers targeting admin accounts from a small set of hosting providers and exporting device configuration files via the FortiGate GUI.

Administrators are urged to check for signs of compromise, reset credentials where needed, and restrict firewall management access to trusted networks. Fortinet recommends upgrading to non-affected versions and disabling FortiCloud SSO login if it is enabled.