Tag: CVE-2025-59718

3 Attack Reports | 1 Vulnerabilities

Attack reports

Stolen Service Accounts Lead to Rogue Workstations and Deep AD Compromise

SentinelOne's DFIR team has responded to multiple incidents involving compromised FortiGate NGFW appliances used to establish footholds in targeted environments. Attackers exploited vulnerabilities or weak credentials to access FortiGate devices, extract configuration files containing service accou…

credential theft

lateral movement

Published: March 11, 2026

Linked vulnerabilities : CVE-2025-59718 (CVSS 9.8), CVE-2025-59719 (CVSS 9.8), CVE-2026-24858 (CVSS 9.8)

Downloadable IOCs: 2

Malicious Configuration Changes Observed On Fortinet FortiGate Devices via SSO Accounts

A new cluster of automated malicious activity involving unauthorized firewall configuration changes on FortiGate devices has been observed. The activity includes creation of generic accounts for persistence, configuration changes granting VPN access, and exfiltration of firewall configurations. The…

unauthorized access

configuration changes

Published: January 22, 2026

Linked vulnerabilities : CVE-2025-59718 (CVSS 9.8), CVE-2025-59719 (CVSS 9.8), CVE-2025-69258 (CVSS 9.8), CVE-2025-25249 (CVSS 8.1), CVE-2025-64155 (CVSS 9.8)

Downloadable IOCs: 5

Malicious SSO Logins Observed Following Disclosure of CVE-2025-59718 and CVE-2025-59719

On December 12, 2025, intrusions involving malicious SSO logins on FortiGate appliances were observed. These attacks followed Fortinet's disclosure of two critical authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719) on December 9. The vulnerabilities allow unauthenticated bypa…

authentication bypass

Published: December 15, 2025

Linked vulnerabilities : CVE-2025-55182 (CVSS 10.0), CVE-2025-59718 (CVSS 9.8), CVE-2025-59719 (CVSS 9.8)

Downloadable IOCs: 4

Click here to see more Attack Reports

Vulnerabilities

CVE-2025-59718

Fortiproxy
Fortiswitchmanager
Fortios

Published: December 9, 2025

Click here to see more Vulnerabilities