Critical Fortinet Flaws Under Active Attack

CISA added a critical Fortinet SAML authentication-bypass vulnerability (CVE-2025-59718) — one of two related high-severity flaws (CVE-2025-59718 and CVE-2025-59719, CVSS 9.1) — to its KEV after vendor and security researchers observed active exploitation where attackers used malicious SSO logins to gain admin access and export device configurations; Fortinet has released patches and recommends disabling FortiCloud SSO or restricting admin access as interim mitigations.