Fortinet Addresses Critical FortiCloud SSO Authentication Bypass Vulnerability
- Securityish
- Threats & Incidents
Quick Summary
Fortinet is working to fully address a critical vulnerability, CVE-2025-59718, related to FortiCloud SSO authentication bypass. Reports indicate that attackers have exploited this vulnerability since January 15, creating accounts with VPN access and stealing firewall configurations. The issue affects Fortinet’s customers, with nearly 11,000 devices exposed online, prompting advisories from CISA to patch within a week.
The Securityish Brief
Fortinet has confirmed ongoing exploitation of the CVE-2025-59718 vulnerability, which allows attackers to bypass authentication on FortiCloud SSO. Reports from customers indicate that even fully patched firewalls have been compromised, with incidents dating back to early December. Cybersecurity firm Arctic Wolf noted that the attacks began on January 15, 2025, where attackers quickly created accounts with VPN access and stole sensitive firewall configurations.
Fortinet’s Chief Information Security Officer, Carl Windsor, acknowledged that the current attacks mirror previous malicious activities observed in December. The company is actively working on a fix for this vulnerability, which is applicable to all SAML SSO implementations, not just FortiCloud.
Logs from affected customers revealed that attackers created admin users following an SSO login from a specific email address and IP address, matching indicators of compromise identified by Arctic Wolf. This suggests a coordinated and automated attack strategy.
As of December 16, 2025, CISA has added CVE-2025-59718 to its list of actively exploited vulnerabilities, urging federal agencies to implement patches within a week. The urgency is underscored by the fact that nearly 11,000 Fortinet devices with FortiCloud SSO enabled are currently exposed online.
Why This Matters for Your Security
Organizations using Fortinet products should be particularly vigilant, as the exploitation of this vulnerability can lead to unauthorized access and significant data breaches. The ability of attackers to create admin accounts and access sensitive configurations poses a serious risk to network security.
Customers are advised to restrict administrative access to their devices and disable FortiCloud SSO until a complete fix is implemented. Monitoring for indicators of compromise is crucial, as any signs of unauthorized access should prompt immediate action to secure systems.
This incident highlights the importance of timely patching and the potential consequences of vulnerabilities that remain unaddressed. Organizations must prioritize their cybersecurity posture and ensure that all systems are regularly updated and monitored for unusual activity.
Key Takeaways
- Restrict administrative access to your Fortinet devices by applying a local-in policy to limit IP addresses.
- Disable the FortiCloud SSO feature on your devices to prevent unauthorized access.
- Monitor your devices for any indicators of compromise and take immediate action if detected.
- Rotate credentials for all accounts, including LDAP/AD accounts, if you suspect a compromise.
- Restore configurations from a known clean version if any unauthorized changes are found.
Key Terms & Concepts
- CVE-2025-59718: In this article, CVE-2025-59718 refers to a critical vulnerability in Fortinet products that allows authentication bypass.
- FortiCloud SSO: FortiCloud SSO is a single sign-on service provided by Fortinet that enables users to access multiple applications with one set of credentials.
- SAML SSO: SAML SSO stands for Security Assertion Markup Language Single Sign-On, a protocol that allows users to authenticate once and gain access to multiple services.
Read the original article here: https://www.bleepingcomputer.com/news/security/fortinet-confirms-critical-forticloud-auth-bypass-not-fully-patched/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
