Fortinet SSO Vulnerabilities Exploited for Admin Access on Firewalls

Fortinet's Single Sign-On (SSO) vulnerabilities, CVE-2025-59718 and CVE-2025-59719, are being actively exploited by attackers to gain unauthorized administrative access to FortiGate firewalls. These flaws allow unauthenticated attackers to bypass SSO authentication and create local admin accounts, affecting internet-exposed devices. Fortinet's PSIRT team is investigating multiple reports of these attacks.