Back Gbhackers

Active Exploitation Of Fortinet SSO Flaw Targets Firewalls For Admin Takeover

Gbhackers •Varshini • January 22, 2026

Threat actors actively exploit critical Fortinet vulnerabilities CVE-2025-59718 and CVE-2025-59719 to bypass FortiCloud SSO authentication on firewalls and proxies. These flaws allow unauthenticated attackers to craft malicious SAML messages, gaining admin access on internet-exposed devices. Fortinet disclosed them on December 9, 2025, with CVSS scores of 9.8, and CISA added CVE-2025-59718 to its Known Exploited […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fortinet SSO Vulnerabilities Exploited for Admin Access on Firewalls Fortinet's Single Sign-On (SSO) vulnerabilities, CVE-2025-59718 and CVE-2025-59719, are being actively exploited by attackers to gain unauthorized administrative access to FortiGate firewalls. These flaws allow unauthenticated attackers to bypass SSO authentication and create local admin accounts, affecting internet-exposed devices. Fortinet's PSIRT team is investigating multiple reports of these attacks. 4 sources 47

Extracted Entities

Active Exploitation Of Fortinet SSO Flaw Targets Firewalls For Admin Takeover

The full story

Extracted Entities

Companies (1)

CVEs (2)

Platforms (1)