In-the-Wild Exploitation of Fresh Fortinet Flaws Begins

Threat actors began exploiting two critical Fortinet authentication bypass vulnerabilities just days after patches were issued, according to Arctic Wolf. The flaws are tracked as CVE-2025-59718 and CVE-2025-59719, with a CVSS score of 9.8, and affect FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. Fortinet rolled out fixes on 9 December, warning that the issues can be exploited via crafted SAML response messages to bypass FortiCloud SSO login authentication.

Arctic Wolf observed malicious SSO logins targeting admin accounts on FortiGate devices starting 12 December, three days after the patches, with intrusions typically exporting device configurations via the GUI interface. The configuration files reportedly contain hashed credentials, and threat actors are known to crack the hashes offline.

Administrators are advised to hunt for malicious activity, reset credentials if discovered, and restrict access to the firewall management interface to trusted internal networks; Fortinet’s patches cover multiple versions across FortiOS, FortiProxy, FortiSwitchManager, and FortiWeb, and the company recommends disabling the FortiCloud SSO administrative login feature to prevent exploitation.