Vulnerability (CVE)
Fortinet, Ivanti, and SAP released patches for critical flaws that could enable authentication bypass and code execution, including Fortinet's CVE-2025-59718 and CVE-2025-59719 (CVSS 9.8), which allow an unauthenticated attacker to bypass FortiCloud SSO...
Apple released security updates across iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari to address two zero-days, CVE-2025-14174 (a memory corruption issue) and CVE-2025-43529 (a use-after-free bug), both exploitable via maliciously crafted web...
Threat actors began exploiting two critical Fortinet FortiGate authentication bypasses, CVE-2025-59718 and CVE-2025-59719 (CVSS 9.8), less than a week after public disclosure, with Arctic Wolf observing malicious SSO logins against the "admin" account on...
WatchGuard released fixes for CVE-2025-14733, a CVSS 9.3 out-of-bounds write in the Fireware OS iked process that lets a remote unauthenticated attacker execute arbitrary code, affecting mobile user VPN and branch office VPN using IKEv2 with a dynamic...
Arctic Wolf reported a new cluster of automated malicious activity beginning January 15, 2026, that made unauthorized configuration changes on Fortinet FortiGate devices by exploiting CVE-2025-59718 and CVE-2025-59719, which allow unauthenticated bypass of...
Fortinet CISO Carl Windsor confirmed that in the last 24 hours the company identified cases where an exploit hit FortiGate devices fully upgraded to the latest release, suggesting a new attack path that bypasses the patches for CVE-2025-59718 and...
Fortinet confirmed fresh exploitation of an incomplete patch for CVE-2025-59718 and CVE-2025-59719, an authentication bypass via crafted SAML messages that hit devices fully upgraded to the latest release when FortiCloud SSO was enabled. The same recap...
SentinelOne reported a campaign in which threat actors exploit FortiGate NGFW appliances, via vulnerabilities such as CVE-2025-59718, CVE-2025-59719, and CVE-2026-24858 or weak credentials, to extract configuration files holding service account credentials...
A campaign codenamed FortiBleed has targeted Fortinet FortiGate firewall and SSL VPN gateway devices worldwide since at least February 2026, with SOCRadar identifying over 80,000 devices whose working usernames and passwords were tested by suspected...
Cisco Talos' year-end Threat Source newsletter recounts 2025 through a Talos Takes episode that traced how ransomware expanded via the as-a-service model, why identity became the main battleground, and how the lines between state-sponsored actors and APTs...