Executive Summary

Threat actors are actively exploiting two critical authentication bypass vulnerabilities, CVE-2025-59718 and CVE-2025-59719, affecting a range of Fortinet products. The flaws, both with a CVSS score of 9.1, allow a remote, unauthenticated attacker to gain administrative access by forging a SAML message to bypass FortiCloud single sign-on (SSO). Security firm Arctic Wolf confirmed observing malicious SSO logins targeting customer FortiGate appliances, primarily aimed at the default 'admin' account. The vulnerability is particularly dangerous because the FortiCloud SSO feature, while disabled by default, is automatically enabled during device registration via the GUI. Fortinet has released patches, and immediate action is required to prevent compromise.

Vulnerability Details

• CVE-2025-59718 & CVE-2025-59719: Improper Signature Verification for SAML Authentication
• CVSS Score: 9.1 (Critical)
• Attack Vector: Remote / Unauthenticated

The core of the vulnerability lies in an improper verification of the cryptographic signature on Security Assertion Markup Language (SAML) messages. When FortiCloud SSO is enabled for administrative logins, an attacker can craft a malicious SAML assertion and send it to the device. The vulnerable device fails to properly validate the signature, trusts the malicious assertion, and grants the attacker an administrative session. This effectively allows a complete bypass of the authentication mechanism.

Affected Systems

The vulnerabilities affect multiple Fortinet products when the FortiCloud SSO feature is enabled:

• FortiOS
• FortiWeb
• FortiProxy
• FortiSwitchManager

Critical Warning: The FortiCloud SSO feature (forticloud-sso-login) is automatically enabled when an administrator registers the device with FortiCare through the web GUI. Many administrators may be unaware this feature is active, leaving their internet-facing devices exposed.

Exploitation Status

The vulnerabilities are being actively exploited in the wild. Arctic Wolf began observing malicious SSO logins on December 12, 2025, just three days after Fortinet's disclosure. The observed attacks have targeted the default 'admin' account and originated from IP addresses associated with hosting providers The Constant Company LLC and Kaopu Cloud HK Limited.

• MITRE ATT&CK Mapping:
  • T1190 - Exploit Public-Facing Application: The attacker targets the web-based management interface of the Fortinet appliance.
  • T1606.002 - SAML Tokens: The core of the attack involves forging SAML tokens to impersonate a legitimate administrator.
  • T1078.001 - Default Accounts: Attackers are specifically targeting the built-in 'admin' account.

Impact Assessment

A successful exploit grants the attacker full administrative access to the Fortinet appliance. This is a worst-case scenario, as these devices are often at the network perimeter. A compromised firewall or web application firewall allows an attacker to:

• Disable security policies and allow malicious traffic into the network.
• Create VPN tunnels to establish a persistent foothold.
• Monitor all network traffic passing through the device.
• Launch further attacks against the internal network.
• Deploy malware or ransomware.

Essentially, a compromise of the primary network security appliance renders all other perimeter defenses moot.

IOCs

Arctic Wolf has observed malicious login attempts from the following IP ranges:

Cyber Observables for Detection

Detection & Response

1. Review Logs: Immediately review system event logs on all Fortinet appliances for successful administrative logins via FortiCloud SSO from unknown or suspicious IP addresses. Pay close attention to logins for the 'admin' account.
2. Threat Hunting: Hunt for any connections to or from the IOC IP addresses provided by Arctic Wolf. This aligns with D3FEND Network Traffic Analysis (D3-NTA).
3. Assume Compromise: If any suspicious SSO login is found, assume the device is fully compromised. Trigger the incident response plan, isolate the device if possible, and prepare to reset it to factory defaults and restore from a clean backup after patching.

Mitigation

1. Patch Immediately: Upgrade to a patched version of the relevant Fortinet software as soon as possible. This is the most effective mitigation and is a direct application of D3FEND Software Update (D3-SU).
2. Disable FortiCloud SSO (Workaround): If patching is not immediately possible, disable the FortiCloud SSO feature. This can be done via the CLI with the following commands:

   config system global
       set forticloud-sso-login disable
   end
   

   This removes the vulnerable attack surface. This is an example of D3FEND Application Configuration Hardening (D3-ACH).
3. Credential Reset: If any suspicious activity is detected, immediately reset the passwords for all administrative accounts on the device.
4. Restrict Admin Access: As a general best practice, restrict administrative access to Fortinet devices to a trusted set of internal IP addresses or a dedicated management network.