Attackers are exploiting auth bypass vulnerability on FortiGate firewalls (CVE-2025-59718)

Attackers are exploiting auth bypass vulnerability on FortiGate firewalls (CVE-2025-59718) Attackers are exploiting a recently revealed vulnerability (CVE-2025-59718) to bypass authentication on Fortinet’s FortiGate firewalls, and are leveraging the achieved access to export their system configuration files, Arctic Wolf researchers warned on Tuesday. Configuration files can expose information about the underlying network and infrastructure, firewall and security policies, encrypted/hashed passwords, and more. Some of this data can come in handy for executing successfuly attacks at a later date. CVE-2025-59718 and CVE-2025-59719 Fortinet discovered CVE-2025-59718 and CVE-2025-59719 internally and patched them earlier this year. Both flaws stem from improper verification of cryptographic signatures. They can be exploited by sending a specially crafted SAML response message to a vulnerable device, which effectively “tells” it that the user initiating the request should be granted access. CVE-2025-59718 affects FortiOS (running on FortiGate firewalls), FortiProxy (running on FortiProxy secure web gateways), and FortiSwitchManager (running on appliances that are used to centrally manage FortiSwitch Ethernet switches). CVE-2025-59719 affects FortiWeb, Fortinet’s web application firewall. The company revealed the vulnerabilities’ existence on December 9, 2025, and urged customers to upgrade to a fixed version or “turn off the FortiCloud login feature (if enabled) temporarily until upgrading to a non-affected version.” Fortinet noted that the FortiCloud SSO login feature is not enabled in default factory settings, but gets switched on if an administrator uses the device’s GUI to register the device to FortiCare – Fortinet’s customer support and maintenance service – but doesn’t disable the “Allow administrative login using FortiCloud SSO” option in the registration page. Action required Arctic Wolf says that it started observing intrusions involving malicious SSO logins on FortiGate appliances on December 12. The SAML response messages were sent from various IP addresses tied to several hosting providers. “Malicious logins were typically against the admin account,” the company noted. “Following malicious SSO logins, configurations were exported to the same IP addresses via the GUI interface. ” Organizations using FortiGate firewalls that have yet to upgrade to a non-vulnerable version and are using the FortiCloud SSO login feature should check their logs for suspicious logins and known indicators of compromise. “If you observe malicious activity similar to the malicious logs described in this security bulletin, assume that hashed firewall credentials stored in the exfiltrated configurations have been compromised, and reset those credentials as soon as possible,” Arctic Wolf researchers advised. They also urged admins in charge of their organization’s network appliances to limit access to management interfaces of firewall and VPN appliances to trusted internal users. CISA has added CVE-2025-59718 to its Known Exploited Vulnerabilities catalog and requires US federal civilian agencies to remediate the flaw by December 23, 2025. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Threat actors have begun to exploit two newly disclosed security flaws in Fortinet FortiGate devices, less than a week after public disclosure. Cybersecurity company Arctic Wolf said it observed active intrusions involving malicious single sign-on (SSO) logins on FortiGate appliances on December 12, 2025. The attacks exploit two critical authentication bypasses (CVE-2025-59718 and CVE-2025-59719, CVSS scores: 9.8). Patches for the flaws were released by Fortinet last week for FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. "These vulnerabilities allow unauthenticated bypass of SSO login authentication via crafted SAML messages, if the FortiCloud SSO feature is enabled on affected devices," Arctic Wolf Labs said in a new bulletin. It's worth noting that while FortiCloud SSO is disabled by default, it is automatically enabled during FortiCare registration unless administrators explicitly turn it off using the "Allow administrative login using FortiCloud SSO" setting in the registration page. In the malicious activity observed by Arctic Wolf, IP addresses associated with a limited set of hosting providers, such as The Constant Company llc, Bl Networks, and Kaopu Cloud Hk Limited, were used to carry out malicious SSO logins against the "admin" account. Following the logins, the attackers have been found to export device configurations via the GUI to the same IP addresses. A spokesperson for Arctic Wolf Labs told The Hacker News that the campaign is still in its early stages, adding that only a relatively small proportion of monitored networks have been affected. "Our investigation is ongoing into the origin and nature of this threat activity, and we are not able to attribute the attacks to any specific threat actor group at this time," it added. "So far, the pattern of activity has appeared to be opportunistic in nature." In light of ongoing exploitation activity, organizations are advised to apply the patches as soon as possible. As mitigations, it's essential to disable FortiCloud SSO until the instances are updated to the latest version and limit access to management interfaces of firewalls and VPNs to trusted internal users. "Although credentials are typically hashed in network appliance configurations, threat actors are known to crack hashes offline, especially if credentials are weak and susceptible to dictionary attacks," Arctic Wolf said. Fortinet customers who find indicators of compromise (IoCs) consistent with the campaign are recommended to assume compromise and reset hashed firewall credentials stored in the exfiltrated configurations. Update The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on December 16, 2025, added CVE-2025-59718 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by December 23, 2025.

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/