Fortinet Firewalls Hacked Despite Patched CVE-2025-59718 Vulnerability
- Securityish
- Threats & Incidents
Quick Summary
Fortinet customers are facing attacks exploiting a patch bypass for the CVE-2025-59718 vulnerability, which was supposed to be fixed in FortiOS 7.4.9. Reports indicate that the latest version, 7.4.10, did not fully address this issue, allowing attackers to create unauthorized admin accounts. With over 25,000 Fortinet devices exposed online, organizations are urged to disable the vulnerable FortiCloud login feature until a complete patch is released.
The Securityish Brief
Fortinet is currently dealing with a significant security issue involving the CVE-2025-59718 vulnerability, which affects its FortiGate firewalls. Despite the release of FortiOS 7.4.9 in December 2025 to address this critical authentication bypass flaw, reports have emerged that the subsequent version, 7.4.10, did not fully resolve the issue. This has led to successful attacks on patched firewalls, with attackers exploiting the vulnerability to create unauthorized admin accounts.
One affected admin reported that their FortiGate device running on version 7.4.9 experienced a malicious single sign-on (SSO) login, resulting in the creation of a local admin account. Logs indicated that this activity mirrored previous exploitation patterns observed by cybersecurity firm Arctic Wolf. Another user confirmed similar unauthorized access, indicating that the vulnerability persists even in the latest updates.
Fortinet has acknowledged the ongoing risk and is planning to release additional updates, including FortiOS 7.4.11, 7.6.6, and 8.0.0, to fully address the vulnerability. Until these patches are available, administrators are advised to disable the FortiCloud login feature, which can be done through the system settings or command-line interface.
While the FortiCloud SSO feature is not enabled by default for devices not registered with FortiCare, over 25,000 devices were found exposed online with this feature enabled. As of now, more than half of these have been secured, but over 11,000 devices remain vulnerable. The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-59718 to its list of actively exploited vulnerabilities, urging federal agencies to apply patches within a week.
Additionally, Fortinet is facing challenges with another critical vulnerability in FortiSIEM, which has publicly available exploit code that could allow attackers to gain root access on unpatched devices. This highlights the urgent need for organizations to monitor their Fortinet devices and apply updates promptly to mitigate risks.
Key Takeaways
- Disable the FortiCloud login feature on your FortiGate devices to prevent unauthorized access.
- Regularly check for updates from Fortinet and apply them as soon as they are available.
- Monitor your system logs for any suspicious activity, such as unauthorized admin account creations.
- Ensure that your devices are not exposed online by checking their configurations and network settings.
- Stay informed about vulnerabilities listed by CISA and other cybersecurity agencies to understand potential risks.
Key Terms & Concepts
- CVE-2025-59718: In this article, CVE-2025-59718 refers to a critical authentication bypass vulnerability affecting Fortinet’s FortiGate firewalls.
- FortiCloud SSO: FortiCloud SSO is a single sign-on feature for Fortinet devices that allows administrative logins via cloud services.
- FortiOS: FortiOS is the operating system used by Fortinet’s security appliances, including FortiGate firewalls.
- CISA: CISA stands for the Cybersecurity and Infrastructure Security Agency, which provides guidance on cybersecurity vulnerabilities and threats.
Read the original article here: https://www.bleepingcomputer.com/news/security/fortinet-admins-report-patched-fortigate-firewalls-getting-hacked/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
