Malicious SSO Logins Observed Following Disclosure of CVE-2025-59718 and CVE-2025-59719

Description

On December 12, 2025, intrusions involving malicious SSO logins on FortiGate appliances were observed. These attacks followed Fortinet's disclosure of two critical authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719) on December 9. The vulnerabilities allow unauthenticated bypass of SSO login authentication via crafted SAML messages when FortiCloud SSO is enabled. Affected products include FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. Malicious logins originated from specific hosting providers, targeting admin accounts. Configuration exports to the same IP addresses were also noted. Recommendations include resetting firewall credentials, limiting management interface access, upgrading to fixed versions, and disabling FortiCloud login if immediate upgrade is not possible.