Fortinet SSO Vulnerability Actively Exploited to Hack Firewalls and Gain Admin Access

Cybersecuritynews •Guru Baran • January 22, 2026

A critical vulnerability in Fortinet’s Single Sign-On (SSO) feature for FortiGate firewalls, tracked as CVE-2025-59718, is under active exploitation. Attackers are leveraging it to create unauthorized local admin accounts, granting full administrative access to internet-exposed devices. Multiple users have reported identical attack patterns, prompting Fortinet’s PSIRT forensics team to investigate. CVE-2025-59718 affects the FortiCloud SSO […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fortinet SSO Vulnerabilities Exploited for Admin Access on Firewalls Fortinet's Single Sign-On (SSO) vulnerabilities, CVE-2025-59718 and CVE-2025-59719, are being actively exploited by attackers to gain unauthorized administrative access to FortiGate firewalls. These flaws allow unauthenticated attackers to bypass SSO authentication and create local admin accounts, affecting internet-exposed devices. Fortinet's PSIRT team is investigating multiple reports of these attacks. 4 sources 47

Extracted Entities

CVEs (1)

CVE-2025-59718

Platforms (2)

FortiCloud Fortigate