Critical FortiGate Devices SSO Vulnerabilities Actively Exploited in the Wild
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
An active intrusion is targeting critical authentication bypass vulnerabilities in Fortinet\u2019s FortiGate appliances and related products.<\/p>\n
Threat actors are exploiting CVE-2025-59718 and CVE-2025-59719 to perform unauthenticated single sign-on (SSO)<\/a> logins via malicious SAML messages, granting attackers administrative access.<\/p>\n Fortinet disclosed the flaws in a PSIRT advisory on December 9, 2025. Arctic Wolf quickly followed with its own security bulletin, urging immediate patching.<\/p>\n The vulnerabilities affect multiple product lines, FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, when FortiCloud SSO is enabled.<\/p>\n FortiCloud SSO<\/a> login remains disabled by default in factory settings. However, it activates automatically during device registration via FortiCare GUI unless administrators explicitly disable the \u201cAllow administrative login using FortiCloud SSO\u201d option. This common oversight exposes internet-facing devices to remote exploitation.<\/p>\n Once enabled, attackers craft SAML assertions to bypass authentication entirely. Arctic Wolf reports<\/a> intrusions originating from a limited set of IP addresses assigned to providers such as The Constant Company LLC and Kaopu Cloud HK Limited. These actors primarily target the default \u201cadmin\u201d account.<\/p>\n