Critical Fortinet Flaws Under Active Attack

CISA warns of active attacks exploiting critical Fortinet vulnerabilities, urging urgent patches to protect devices.

Dec 18, 2025

ON THIS PAGE

CISA added a critical Fortinet vulnerability (CVE-2025-59718) to its exploited vulnerabilities catalog after detecting active attacks. The flaw, along with CVE-2025-59719, allows hackers to bypass authentication on FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager devices using crafted SAML messages.

Arctic Wolf researchers spotted attacks starting December 12, just three days after Fortinet disclosed the vulnerabilities on December 9. Attackers from Germany, the US, and Asia targeted admin accounts, stealing device configurations and credentials from compromised FortiGate devices.

The vulnerabilities affect devices with FortiCloud SSO enabled, which automatically activates when administrators register through the GUI. Federal agencies must patch by December 23 or stop using affected products. Organizations can temporarily disable FortiCloud login while implementing patches across multiple Fortinet product versions.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?