Fortinet Confirms Active Exploitation of FortiCloud SSO Bypass Vulnerability

Fortinet confirmed active exploitation of two critical FortiCloud SSO authentication‑bypass vulnerabilities (CVE-2025-59718, CVE-2025-59719) affecting multiple product lines (FortiOS, FortiWeb, FortiProxy, FortiSwitch Manager). Attackers can craft malicious SAML messages to gain unauthenticated administrative access; exploitation has been observed in customer environments, and Fortinet has published patch versions and recommends disabling FortiCloud SSO as a temporary mitigation.