Critical FortiGate Devices SSO Vulnerabilities Actively Exploited in the Wild

Cybersecuritynews •Abinaya • December 16, 2025

An active intrusion is targeting critical authentication bypass vulnerabilities in Fortinet’s FortiGate appliances and related products. Threat actors are exploiting CVE-2025-59718 and CVE-2025-59719 to perform unauthenticated single sign-on (SSO) logins via malicious SAML messages, granting attackers administrative access. Fortinet disclosed the flaws in a PSIRT advisory on December 9, 2025. Arctic Wolf quickly followed with […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Exploitation of FortiGate SSO Vulnerabilities by Threat Actors Threat actors are actively exploiting critical authentication bypass vulnerabilities in Fortinet's FortiGate appliances, specifically CVE-2025-59718 and CVE-2025-59719. These vulnerabilities allow unauthenticated single sign-on (SSO) logins via malicious SAML messages, granting administrative access to attackers. Fortinet disclosed these flaws in a PSIRT advisory on December 9, 2025. 4 sources 88

Extracted Entities

Critical FortiGate Devices SSO Vulnerabilities Actively Exploited in the Wild

The full story

Extracted Entities

Companies (1)

CVEs (2)

Platforms (1)