CVE-2025-59718

CVE

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

December 9, 2025

Last Seen

March 11, 2026

API

Exploited in Wild

—

Ransomware Use

—

Public Exploits

—

Attack Vector

—

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Exploitation of FortiGate SSO Vulnerabilities by Threat Actors88.3

Threat actors are actively exploiting critical authentication bypass vulnerabilities in Fortinet's FortiGate appliances, specifically CVE-2025-59718 and CVE-2025-59719. These vulnerabilities allow unauthenticated single sign-on (SSO) logins via malicious SAML messages, granting administrative access...

Fortinet Issues Security Advisory for Critical Vulnerabilities72.0

On March 10, 2026, Fortinet released a security advisory addressing eleven vulnerabilities in its core products, including a high-severity stack-based buffer overflow in FortiManager (CVE-2025-54820) that allows remote unauthenticated attackers to execute unauthorized commands. The vulnerabilities a...

Over 10,000 Fortinet Firewalls Vulnerable to 2FA Bypass Exploits47.1

More than 10,000 Fortinet firewalls remain exposed to a critical two-factor authentication bypass vulnerability (CVE-2020-12812) that has been actively exploited. This flaw, first disclosed in July 2020, continues to pose risks as many devices have not been patched, with ongoing attacks reported rec...

Fortinet Addresses Critical Vulnerabilities in Key Products46.9

Fortinet has released security updates to address critical vulnerabilities (CVE-2025-59718 and CVE-2025-59719) affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager products. Users and administrators are advised to update to the latest version immediately to mitigate potential risks.

Public Exploits

Checking GitHub for proof-of-concept code…

Related Clusters (13)

1 / 3

Related Entities

Volt Typhoon Zero-day Exploit Data Breach Malware Brute Force Ransomware Fortinet Dutch Ministry Of Defence Arctic Wolf AWS CISA Cloudflare

CVE-2025-59718

Vulnerability Overview

Exploitation Activity

Exploitation Intelligence

Public Exploits

CVE Details

Related Clusters (13)

Exploitation of FortiGate SSO Vulnerabilities by Threat Actors

Fortinet Issues Security Advisory for Critical Vulnerabilities

Over 10,000 Fortinet Firewalls Vulnerable to 2FA Bypass Exploits

Fortinet Addresses Critical Vulnerabilities in Key Products

Fortinet SSO Vulnerabilities Exploited for Admin Access on Firewalls

Critical Vulnerabilities Found in Fortinet Products

Fortinet FortiWeb CVE-2025-64446 Exploited for Admin Takeover

CISA Adds Critical Fortinet Vulnerability to KEV Catalog Amid Active Exploitation

Critical Vulnerability in Ivanti Endpoint Manager Requires Immediate Patching

Fortinet Addresses Critical SSO Authentication Bypass Vulnerabilities

Fortinet Confirms Exploitation of FortiCloud SSO Bypass Vulnerability

Exploited CVE-2025-59718 Compromises FortiGate Firewalls Despite Patches

Over 25,000 Fortinet Devices Vulnerable to Attacks via FortiCloud SSO

Related Articles (22)

FortiGate FortiCloud SSO Authentication Bypass: Active Exploitation of CVE-2025

SIEM Rules for detecting exploitation of vulnerabilities in FortiCloud SSO

Fortinet’s latest zero

Fortinet confirms new zero

FortiGate Firewalls Targeted in Automated Attacks to Harvest Configuration Data

Fortinet Confirms Active Exploitation of FortiCloud SSO Authentication Bypass Vulnerability

Active Exploitation Of Fortinet SSO Flaw Targets Firewalls For Admin Takeover

Fortinet SSO Vulnerability Actively Exploited to Hack Firewalls and Gain Admin Access

Fully patched FortiGate firewalls are getting compromised via CVE-2025-59718?

Over 10K Fortinet firewalls exposed to actively exploited 2FA bypass

Potential attacks threaten over tens of thousands of Fortinet devices

Over 25,000 FortiCloud SSO devices exposed to remote attacks

CISA Adds Fortinet Vulnerability to KEV Catalog After Active Exploitation

Most smart devices run outdated web browsers

CISA: Multiple Fortinet Products Exploited In Attacks, Rapid Patching Urged

Critical FortiGate Devices SSO Vulnerabilities Actively Exploited in the Wild

AL25-019 - Vulnerabilities impacting Fortinet products

Critical Vulnerabilities in Multiple Fortinet Products

Fortinet admins urged to update software to close FortiCloud SSO holes

CC-4724

Ivanti patches Endpoint Manager flaw allowing remote code execution

Fortinet warns of critical FortiCloud SSO login auth bypass flaws

Related Entities