25,000+ FortiCloud SSO-Enabled Devices Exposed to Remote Attacks

Shadowserver detected more than 25,000 Fortinet devices worldwide openly advertising FortiCloud Single Sign-On (SSO), raising exposure of management interfaces; the advisory links this exposure to two notable CVEs (CVE-2025-59718 and CVE-2025-59719) and provides affected/fixed versions and mitigation guidance (patching, restrict SSO to VPN/private IPs, enable MFA, monitor logs).