ARCTIC WOLF OBSERVES MALICIOUS SSO LOGINS ON FORTIGATE DEVICES FOLLOWING DISCLOSURE OF CVE-2025-59718 AND CVE-2025-59719

Summary from the TLDR InfoSec newsletter

Arctic Wolf observed active exploitation of critical Fortinet authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719) starting December 12, just three days after Fortinet's disclosure. Attackers used crafted SAML messages to gain unauthenticated admin access to FortiGate devices with FortiCloud SSO enabled. Threat actors logged in via SSO from hosting provider IPs and immediately exfiltrated device configurations containing hashed credentials via the GUI. Organizations should promptly upgrade affected versions of FortiOS, FortiProxy, FortiWeb, and FortiSwitchManager, disable FortiCloud SSO as a workaround, reset all firewall credentials if compromise indicators are observed, and restrict management interface access to trusted internal networks.