Fortinet confirms critical FortiCloud auth bypass not fully patched

Fortinet confirmed active exploitation of a critical FortiCloud SSO authentication bypass (CVE-2025-59718) that has been used in automated campaigns to create admin accounts and steal firewall configurations, including on devices reported as fully patched. Customers and researchers observed matching IOCs and rapid post-exploitation activity; Fortinet is developing a full fix while advising immediate mitigations (disable FortiCloud SSO, restrict admin access, rotate credentials) and authorities (CISA) have added the CVE to their known-exploited list.