Fortinet Forti Gate Under Active Attack Through SAML SSO Authentication Bypass
Summary: Threat actors began exploiting two critical Fortinet FortiGate authentication bypasses, CVE-2025-59718 and CVE-2025-59719 (CVSS 9.8), less than a week after public disclosure, with Arctic Wolf observing malicious SSO logins against the "admin" account on December 12, 2025. The flaws allow unauthenticated bypass of SSO login via crafted SAML messages when FortiCloud SSO is enabled, which happens automatically during FortiCare registration unless administrators turn it off.
Why it matters: Attackers logged in through hosting providers including The Constant Company, Bl Networks, and Kaopu Cloud Hk Limited and exported device configurations via the GUI, and Arctic Wolf notes those configs hold hashed credentials that can be cracked offline. CISA added CVE-2025-59718 to its KEV catalog on December 16, 2025, with a December 23 deadline for federal civilian agencies.