Fortinet SSO Vulnerability Actively Exploited to Hack Firewalls and Gain Admin Access

### Executive Summary A critical FortiGate Single Sign-On (SSO) vulnerability (CVE-2025-59718) is being actively exploited to create persistent local administrator accounts on internet-exposed devices; exploitation has been observed on FortiOS 7.4.9/7.4.10 and similar branches, with reports of over 25,000 devices potentially exposed. Fortinet is investigating, scheduled fixes are referenced for upcoming releases, and immediate mitigations (disable FortiCloud SSO, audit logs, network segmentation, and patching) are recommended.