Critical FortiGate Devices SSO Vulnerabilities Actively Exploited in the Wild

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Exploitation of FortiGate SSO Vulnerabilities by Threat Actors Threat actors are actively exploiting critical authentication bypass vulnerabilities in Fortinet's FortiGate appliances, specifically CVE-2025-59718 and CVE-2025-59719. These vulnerabilities allow unauthenticated single sign-on (SSO) logins via malicious SAML messages, granting administrative access to attackers. Fortinet disclosed these flaws in a PSIRT advisory on December 9, 2025. 4 sources 88