Critical Fortinet Flaws Under Active Attack

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a recently disclosed security flaw affecting multiple Fortinet network security and management platforms to its known exploited vulnerabilities (KEV) catalog, citing evidence of active exploitation.

The vulnerability tracked as CVE-2025-59718 (CVSS Score: 9.1) is one of two critical authentication bypass flaws—the other is CVE-2025-59719 (CVSS Score: 9.1)—that Fortinet disclosed on 9 December in its FortiOS, FortiWeb, FortiProxy and FortiSwitchManager products.

Authentication bypass is possible when FortiCloud SSO is enabled, allowing an unauthenticated attacker to bypass SSO login using specially crafted SAML messages by exploiting improper verification of cryptographic signatures, potentially giving threat actors admin control of affected devices.

Arctic Wolf notes that attack activity targeting both vulnerabilities appears to have started as early as 12 December, with intrusions involving malicious SSO logins on FortiGate devices originating from a small number of hosting providers located in Germany, the US and Asia, and attackers exporting device configurations and credentials after authentication bypass.

Fortinet has released patches across multiple product lines and provides a temporary workaround of disabling FortiCloud login to mitigate exposure until upgrades are applied; organisations are urged to patch promptly and to monitor for indicators of compromise such as unauthorized admin accounts and unusual SSL VPN authentication.