Fortinet FortiCloud SSO Authentication Bypass Vulnerabilities Actively Exploited (CVE-2025-59718, CVE-2025-59719)

Active exploitation was observed beginning December 12, 2025, of two critical Fortinet SSO authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719) that permit unauthenticated attackers to gain administrative access and export device configurations on FortiCloud SSO-enabled FortiOS, FortiProxy, FortiSwitchManager, and FortiWeb devices; Fortinet released patches on December 9, 2025, and the advisory provides IOCs, example logs, recommended fixed versions, and temporary mitigations such as disabling FortiCloud SSO.