Critical FortiGate Devices SSO Vulnerabilities Actively Exploited in the Wild
Active intrusions are exploiting authentication bypass vulnerabilities in Fortinet's FortiGate appliances and related products. The vulnerabilities, identified as CVE-2025-59718 and CVE-2025-59719, allow unauthenticated single sign-on (SSO) logins via…
Active intrusions are exploiting authentication bypass vulnerabilities in Fortinet's FortiGate appliances and related products. The vulnerabilities, identified as CVE-2025-59718 and CVE-2025-59719, allow unauthenticated single sign-on (SSO) logins via malicious SAML messages, granting attackers administrative access.
Fortinet disclosed these vulnerabilities in a PSIRT advisory on December 9, 2025. Arctic Wolf subsequently issued a security bulletin urging immediate patching. The vulnerabilities impact multiple product lines, including FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, when FortiCloud SSO is enabled.
By default, FortiCloud SSO login is disabled in factory settings but becomes enabled during device registration via FortiCare GUI unless explicitly turned off by administrators. This oversight can expose internet-facing devices to remote exploitation. Once enabled, attackers can craft SAML assertions to bypass authentication. Intrusions have been traced to a limited set of IP addresses associated with providers such as The Constant Company LLC and Kaopu Cloud HK Limited, primarily targeting the default "admin" account.
IOC Hosting Provider
45.32.153[.]218 The Constant Company LLC 167.179.76[.]111 The Constant Company LLC 199.247.7[.]82 The Constant Company LLC 45.61.136[.]7 Bl Networks 38.54.88[.]203 Kaopu Cloud HK Limited 38.54.95[.]226 Kaopu Cloud HK Limited 38.60.212[.]97 Kaopu Cloud HK Limited
Sample logs from compromised FortiGate devices show successful SSO logins and subsequent configuration exports by attackers:
Active intrusions are exploiting authentication bypass vulnerabilities in Fortinet's FortiGate appliances and related products.
date=2025-12-12 time=REDACTED ... logid="0100032001" ... user="admin" ui="sso(199.247.7[.]82)" method="sso" srcip=199.247.7[.]82 ... action="login" status="success" ... date=2025-12-12 time=REDACTED ... logid="0100032095" ... action="download" ... msg="System config file has been downloaded by user admin via GUI(199.247.7[.]82)"
Arctic Wolf's managed detection and response (MDR) platform identifies these patterns and alerts affected customers. Fortinet has released fixed versions across affected product branches. Products such as FortiOS 6.4, FortiWeb 7.0, and FortiWeb 7.2 are not affected.
Product Affected Versions Fixed Version
FortiOS 7.6 7.6.0 – 7.6.3 7.6.4+ FortiOS 7.4 7.4.0 – 7.4.8 7.4.9+ FortiOS 7.2 7.2.0 – 7.2.11 7.2.12+ FortiOS 7.0 7.0.0 – 7.0.17 7.0.18+ FortiProxy 7.6 7.6.0 – 7.6.3 7.6.4+ FortiProxy 7.4 7.4.0 – 7.4.10 7.4.11+ FortiProxy 7.2 7.2.0 – 7.2.14 7.2.15+ FortiProxy 7.0 7.0.0 – 7.0.21 7.0.22+ FortiSwitchManager 7.2 7.2.0 – 7.2.6 7.2.7+ FortiSwitchManager 7.0 7.0.0 – 7.0.5 7.0.6+ FortiWeb 8.0 8.0.0 8.0.1+ FortiWeb 7.6 7.6.0 – 7.6.4 7.6.5+ FortiWeb 7.4 7.4.0 – 7.4.9 7.4.10+
Organizations encountering malicious logs should reset all firewall credentials immediately. Even hashed passwords in exported configurations are susceptible to offline dictionary attacks on weak passwords. Management interfaces should be restricted to trusted internal networks only.
As a temporary workaround, disable FortiCloud SSO by navigating to System > Settings and toggling "Allow administrative login using FortiCloud SSO" to Off, or run the following CLI command:
config system global set admin-forticloud-sso-login disable end
Organizations are advised to prioritize upgrades to mitigate rising firewall targeting threats. Arctic Wolf emphasizes ongoing vigilance, with continued detections and alerts for affected clients.
Based on reporting by Cyber Security News.