Critical Fortinet FortiGate Auth Bypass Under Active Exploitation

Threat actors are actively exploiting two critical authentication bypass vulnerabilities in Fortinet FortiGate devices, with attacks observed just three days after patches were released. Organizations using FortiCloud SSO should treat this as an emergency patching priority.

Vulnerability Overview

CVE IDs: CVE-2025-59718, CVE-2025-59719 CVSS Score: 9.8 (Critical) Affected Products: FortiOS, FortiProxy, FortiSwitchManager, FortiWeb Patch Released: December 9, 2025 Active Exploitation Began: December 12, 2025

Both vulnerabilities stem from improper verification of cryptographic signatures in the FortiCloud SSO login flow. An unauthenticated attacker can send a crafted SAML response to bypass authentication entirely and gain administrative access to affected devices.

Attack Timeline and Observations

According to Arctic Wolf, researchers observed malicious SSO logins targeting FortiGate devices starting December 12, 2025—just three days after Fortinet published its security advisory.

The attacks follow a consistent pattern:

1. Initial Access: Attackers perform malicious SSO logins, primarily targeting the "admin" account
2. Configuration Exfiltration: After successful authentication, attackers use the FortiGate GUI to download device configuration files
3. Credential Harvesting: Exported configurations contain hashed passwords vulnerable to offline cracking

Attack traffic has been traced to IP addresses associated with hosting providers including The Constant Company LLC, BL Networks, and Kaopu Cloud HK Limited.

Who Is Vulnerable?

The critical detail many administrators may miss: FortiCloud SSO is automatically enabled when registering a device to FortiCare unless explicitly disabled during registration.

From Fortinet's advisory: "When an administrator registers the device to FortiCare from the device's GUI, unless the administrator disables the toggle switch 'Allow administrative login using FortiCloud SSO' in the registration page, FortiCloud SSO login is enabled upon registration."

This means organizations that registered devices through the GUI without paying close attention to this setting are likely vulnerable.

Unaffected Versions

• FortiOS 6.4
• FortiWeb 7.0
• FortiWeb 7.2

Patched Versions

Organizations must upgrade to the following versions:

Product	Fixed Versions
FortiOS	7.6.4, 7.4.9, 7.2.12, 7.0.18
FortiProxy	7.6.4, 7.4.11, 7.2.15, 7.0.22
FortiSwitchManager	7.2.7, 7.0.6

Immediate Mitigation Steps

If patching cannot be completed immediately:

1. Disable FortiCloud SSO on all affected devices where it is enabled
2. Restrict management interface access to trusted internal networks or VPN only—no direct internet exposure
3. Review authentication logs for signs of unauthorized SSO logins
4. Reset all firewall credentials if any indicators of compromise are identified

Even hashed passwords in exported configurations remain vulnerable to offline dictionary attacks, so credential rotation is essential if compromise is suspected.

Detection Guidance

Security teams should monitor for:

• Unexpected SSO authentication events, particularly for the "admin" account
• Configuration export operations from unfamiliar IP addresses
• Management interface access from hosting provider IP ranges
• Multiple failed authentication attempts followed by successful SSO login

The Bigger Picture

This incident highlights a recurring pattern in the security industry: threat actors are weaponizing vulnerabilities faster than ever. A three-day window between patch release and active exploitation leaves minimal time for organizations to respond.

The automatic enablement of FortiCloud SSO during device registration also serves as a reminder to security teams: default configurations should always be reviewed and hardened, especially for internet-facing security appliances.

Resources

• Fortinet Security Advisory
• Arctic Wolf Analysis
• Australian Cyber Security Centre Alert

---

Organizations running Fortinet products should prioritize patching and conduct thorough log reviews for signs of compromise.