Exploitation of FortiGate SSO Vulnerabilities by Threat Actors

First seen 16 Dec 2025, 16:58 UTC • Cybersecuritynews

•88

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Threat actors are actively exploiting critical authentication bypass vulnerabilities in Fortinet's FortiGate appliances, specifically CVE-2025-59718 and CVE-2025-59719. These vulnerabilities allow unauthenticated single sign-on (SSO) logins via malicious SAML messages, granting administrative access to attackers. Fortinet disclosed these flaws in a PSIRT advisory on December 9, 2025.

How this analysis works

Attack Flow

8 entities, 9 inferred relationships (STIX 2.1).

Threat Actor (1)

XHunt

Technique (2)

Malware
Zero-day Exploit

Organization (1)

Fortinet

Vulnerability (3)

CVE-2025-59718
CVE-2025-59719
FortiGate SSO Vulnerability

Affected Platform (1)

Fortigate

Relationships

XHunt uses Malware
XHunt uses Zero-day Exploit
XHunt exploits CVE-2025-59718
XHunt exploits CVE-2025-59719
XHunt exploits FortiGate SSO Vulnerability
CVE-2025-59718 targets Fortigate
CVE-2025-59719 targets Fortigate
FortiGate SSO Vulnerability targets Fortigate
XHunt targets Fortinet

Continue Reading

xHunt APT Targets Microsoft Exchange and IIS with Custom Backdoors ZnDoor Malware Targets React2Shell Vulnerability in Japanese Networks

Exploitation of FortiGate SSO Vulnerabilities by Threat Actors

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading