Arctic Wolf Observes Malicious SSO Logins on FortiGate Devices Following Disclosure of CVE-2025-59718 and CVE-2025-59719

Arctic Wolf observed active exploitation beginning 12 December 2025 of two critical Fortinet SSO authentication bypass vulnerabilities (CVE-2025-59718, CVE-2025-59719) that allowed unauthenticated admin logins and subsequent configuration downloads; multiple Fortinet product lines are affected and Arctic Wolf provides IOC IPs, example logs, and remediation steps including upgrading to fixed versions, disabling FortiCloud SSO, and resetting credentials.