Previously Patched Fortinet Vulnerability (CVE-2025-59718) Exploited in the Wild

THE THREAT

A critical authentication bypass vulnerability, CVE-2025-59718 (CVSS: 9.8), affecting multiple Fortinet products including FortiOS, FortiWeb, FortiProxy, and FortiSwitchManage, is currently being exploited by threat actors. The flaw allows an unauthenticated attacker to bypass FortiCloud Single Sign-On (SSO) authentication by sending a specially crafted SAML message. Fortinet disclosed the flaw and released patches on December 9th, 2025, and was followed by confirmation of exploitation in the wild. However, recent reports from Fortinet customers indicate that the fix did not fully mitigate the issue, as the vulnerability remains exploitable in FortiOS 7.4.9.

While Fortinet has not released an official statement yet, the ongoing exploitation raises concern as the patch released in December does not seem to be working. Organizations with FortiOS 7.4.9 and other products with the patches applied are thus recommended to disable the FortiCloud SSO feature to mitigate the risk of potential exploitation.

What we're doing about it

• eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify vulnerable devices for CVE-2025-59718
• eSentire MDR for Network has detections to identify exploitation of CVE-2025-59718
• eSentire MDR for Log includes detections designed to identify behaviors associated with the exploitation of Fortinet devices
• Threat Response Unit (TRU) has conducted threat hunts across eSentire customers
• The eSentire Threat Intelligence team is tracking CVE-2025-59718 for additional detection opportunities

What you should do about it

• Until the complete patches are made available, disable the FortiCloud SSO login feature
  • To disable FortiCloud login,
    • Navigate to System -> Settings and switch "Allow administrative login using FortiCloud SSO" to Off
    • OR run the following command in Command Line Interface:
      config system global
      set admin-forticloud-sso-login disable 
      end
• Monitor for creation of unauthorized administrator accounts

Additional information

Multiple Fortinet customers have reported observing malicious SSO logins on Fortinet devices running FortiOS 7.4.9. In these incidents, administrators identified unauthorized logins via FortiCloud SSO, followed by the creation of rogue administrative accounts with names such as "helpdesk" and "audit." The affected organizations confirmed that their systems had been patched as part of the December security update addressing CVE-2025-59718, indicating that the patch did not fully mitigate the vulnerability.

Arctic Wolf (AW) also reported similar observations, with the activity beginning on January 15th, 2026. The observed campaign focused on creating generic accounts to establish persistence, making configuration changes to grant VPN access to those accounts, and exfiltrating firewall configuration data. The activity was traced back to two malicious accounts, "cloud-init@mail [.] io" and "cloud-noc@mail [.] io." In the observed cases, a successful SSO login was followed by rapid exfiltration of configuration data and the creation of a secondary account to maintain persistence. The follow-on actions occurred rapidly after the initial login, suggesting that the operation is automated. Following the disclosure of CVE-2025-59718 in December 2025, AW identified intrusion activity resembling the incidents observed in January 2026. Given the similarity in the malicious behavior, these activities are likely linked to the exploitation of CVE-2025-59718.

While Fortinet has not issued an official statement, the company is reportedly working on releasing FortiOS 7.4.11, 7.6.6, and 8.0 to fully address the vulnerability. Until these updates are available, organizations are advised to disable the FortiCloud SSO login feature. This feature is not enabled by default and is only active if the "Allow administrative login using FortiCloud SSO" option was manually enabled during device registration with FortiCare.

As this is a developing topic and more information is likely to surface in the near future, the eSentire Threat Intelligence team is continuously tracking it for additional details. The eSentireThreat Intelligence team published an initial security advisory addressing CVE-2025-59718 on December 17th, 2025.

References:
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-59718 
[2] https://www.fortiguard.com/psirt/FG-IR-25-647 
[3] https://www.cisa.gov/news-events/alerts/2025/12/16/cisa-adds-one-known-exploited-vulnerability-catalog 
[4] https://www.bleepingcomputer.com/news/security/fortinet-admins-report-patched-fortigate-firewalls-getting-hacked/ 
[5] https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-configuration-changes-fortinet-fortigate-devices-via-sso-accounts/
[6] https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/
[7] https://www.esentire.com/security-advisories/fortinet-vulnerability-exploited-in-the-wild-cve-2025-59718