The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-59718 to its Known Exploited Vulnerabilities (KEV) catalog, confirming that it is being actively exploited in the wild.
The vulnerability is one of two critical authentication bypass flaws disclosed by Fortinet on December 9, affecting:
- FortiOS
- FortiWeb
- FortiProxy
- FortiSwitchManager
What’s the risk?
Both CVE-2025-59718 and CVE-2025-59719 (CVSS 9.1) allow unauthenticated attackers to bypass SSO authentication using specially crafted SAML messages when FortiCloud SSO is enabled.
Successful exploitation can give attackers:
- Administrator access
- Control over firewall policies
- Visibility into network topology
- Access to hashed credentials and configs
Active exploitation observed
According to Arctic Wolf, attacks began within days of disclosure and included:
- Malicious SSO logins targeting admin accounts
- Configuration exports to attacker-controlled IPs
- Infrastructure is traced to hosting providers in Germany, the US, and Asia
Why is exposure higher than expected
While FortiCloud SSO is disabled by default, it automatically enables during device registration via FortiCare unless explicitly turned off — a design choice that may have exposed more devices than organizations realized.
Threat actors frequently scan for internet-facing firewall management interfaces, making these devices high-value targets.
Remediation & mitigation
✔ Patch immediately:
- FortiOS 7.6.4, 7.4.9, 7.2.12, 7.0.18 or later
- Equivalent fixed versions for FortiWeb, FortiProxy, FortiSwitchManager
✔ If patching is delayed:
- Disable FortiCloud SSO
- Restrict admin HTTP/HTTPS access to trusted IPs
- Monitor for IoCs (new admin accounts, suspicious SSO activity)
⚠️ Federal agencies must remediate by Dec. 23 or discontinue use.
Key takeaway
Fortinet devices sit at the network perimeter. A single compromise can enable:
- Rogue admin creation
- VPN access for lateral movement
- Persistent future attacks using stolen configs
Organizations should assume credential compromise if suspicious activity is detected and act immediately.
