Fortinet FortiGate Under Active Attack Through SAML SSO Authentication Bypass
Overview
Fortinet FortiGate devices are currently under active attack due to two recently disclosed vulnerabilities, CVE-2025-59718 and CVE-2025-59719, which allow for authentication bypass through malicious single sign-on (SSO) logins. Cybersecurity firm Arctic Wolf reported observing these attacks on December 12, 2025, just days after the vulnerabilities were made public. This situation poses significant risks for organizations using FortiGate appliances, as attackers can potentially gain unauthorized access to sensitive systems. Companies using these devices should take immediate action to protect their networks and data from these ongoing intrusions.
Key Takeaways
- Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
- Affected Systems: Fortinet FortiGate devices, specifically those vulnerable to CVE-2025-59718 and CVE-2025-59719.
- Action Required: Organizations should apply security patches released by Fortinet for the affected FortiGate devices.
- Timeline: Newly disclosed
Original Article Summary
Threat actors have begun to exploit two newly disclosed security flaws in Fortinet FortiGate devices, less than a week after public disclosure. Cybersecurity company Arctic Wolf said it observed active intrusions involving malicious single sign-on (SSO) logins on FortiGate appliances on December 12, 2025. The attacks exploit two critical authentication bypasses (CVE-2025-59718 and CVE-2025-59719
Impact
Fortinet FortiGate devices, specifically those vulnerable to CVE-2025-59718 and CVE-2025-59719.
Exploitation Status
This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.
Timeline
Newly disclosed
Remediation
Organizations should apply security patches released by Fortinet for the affected FortiGate devices. Additionally, it is advisable to review and strengthen SSO configurations and monitor logs for any unusual login attempts.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.
Related Topics: This incident relates to CVE, Fortinet, Exploit, and 2 more.