CVE-2025-59719

📌 استغلال ثغرات في جدران حماية FortiGate لاختراق الشبكات وسرقة بيانات الاعتماد 🛡️ الفئة: هجوم سيبراني 📝 الملخص: رصدت عمليات اختراق متعددة استهدفت جدران

📌 استغلال ثغرات في جدران حماية FortiGate لاختراق الشبكات وسرقة بيانات الاعتماد رصدت عمليات اختراق متعددة استهدفت جدران الحماية FortiGate (NGFW) في أوائل عام 2026، حي

FortiGate NGFWs exploited since Nov 2025 via #CVE-2025-59718, CVE-2025-59719, CVE-2026-24858 to steal LDAP credentials & exfiltrate NTDS.dit. Patch immediately. #threatintel #mssp #cybersecurity #mssp

FortiGate機器を入口としたネットワーク侵害について。SentinelOne社報告。CVE-2025-59718、CVE-2025-59719、CVE-2026-24858で例示される既知の脆弱性の悪用。 https://t.co/YDeBMmdsL4

⚠️ Vulnerabilidades en productos Fortinet ❗ CVE-2025-59719 ❗ CVE-2025-59718 ➡️ Más info: https://t.co/ZIVEEsEM7e https://t.co/zK6Nwjxc0y

🚨 We are observing active exploitation of CVE-2025-59718 and CVE-2025-59719, targeting FortiCloud SSO to bypass authentication. Attackers are using these flaws to maintain valid sessions and persistence even after the underlying devices are fully patched. Patching closes the

Fortinet confirms active FortiCloud SSO bypass affecting fully patched FortiGate firewalls, exploiting CVE-2025-59718 and CVE-2025-59719. Vulnerability allows persistent accounts, VPN access, and config theft. #FortinetRisk #SSOVulnerability #USA https://t.co/tYboJhOZlB

🚨 ALERTA FORTINET Firewalls FortiGate PARCHEADOS estan siendo hackeados - Parche de diciembre NO funciona - Atacantes crean backdoors en SEGUNDOS - Roban configs completas Solucion temporal: Desactivar FortiCloud SSO CVE-2025-59718 / CVE-2025-59719 #fortinet #cibersegurid

Fortinet confirms FortiCloud SSO exploitation bypassing patches for CVE-2025-59718 and CVE-2025-59719. Attackers automate account creation, enable VPNs, and extract configs from FortiGate devices. #FortiCloudBreach #NetworkSecurity #USA https://t.co/XSELNE3X3q

🚨 Fortinet Confirms Active FortiCloud SSO Bypass Still Hits Fully Patched FortiGate Firewalls Fortinet confirmed attackers are exploiting a patch-bypass path for FortiCloud SSO auth flaws (CVE-2025-59718 / CVE-2025-59719) using crafted SAML messages, allowing persistence via n

Onderzoekers melden actief misbruik in FortiCloud van kwetsbaarheden met kenmerken CVE-2025-59718 en CVE-2025-59719. Lees hier onze update van het high/high beveiligingsadvies: https://t.co/OwAkGwvQKz

🚨 Fortinet Confirms Active Exploitation of FortiCloud SSO Auth Bypass Targeting Even Patched FortiGates Fortinet confirmed an automated campaign abusing FortiCloud SSO authentication-bypass flaws (CVE-2025-59718 / CVE-2025-59719) to create rogue admin accounts, exfiltrate

Fortinetは、FortiGateを狙った攻撃で新たな攻撃経路が使われていると明らかにした。2025年12月に公表されたCVE-2025-59718およびCVE-2025-59719はFortiCloudのSSO機能を悪用した認証回避だったが、今回は修正後の最新版でも

Starting January 15, 2026, attackers exploited CVE-2025-59718 and CVE-2025-59719 to bypass FortiCloud SSO on FortiGate devices, altering firewall configs, creating admin accounts, and exporting sensitive data. #FortiGateAttacks #SSOBypass #USA https://t.co/dZsIDyQaGO

A new cluster of automated malicious activity involving unauthorized firewall configuration changes on FortiGate devices. CVE-2025-59718 & CVE-2025-59719 #IOC https://t.co/X1i6yIgOxh

csirt_it: ‼️ #Exploited #Fortinet: rilevato possibile bypass di aggiornamenti rilasciati a Dicembre per le CVE-2025-59718 e CVE-2025-59719 🔗 https://t.co/cOKFFdSy7P https://t.co/abBVDuijyQ

‼️ #Exploited #Fortinet: rilevato possibile bypass di aggiornamenti rilasciati a Dicembre per le CVE-2025-59718 e CVE-2025-59719 🔗 https://t.co/EMOH8biqER https://t.co/7RoZa7D4qH

In early December, Fortinet released an advisory for two critical authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719). Shortly after disclosure, Arctic Wolf began observing intrusions involving malicious SSO logins on FortiGate appliances. Malicious logins

🚨 Fortinet SSO Bypass Under Active Attack The chatter isn't about failing patches. It’s about two critical auth bypass flaws (CVE-2025-59718 & CVE-2025-59719) in unpatched devices. Attackers began exploiting them within 72 hours of disclosure. The vulnerable component

CVE-2025-59718 / CVE-2025-59719 Fortinet Poc https://t.co/8HgEks7nb5 #CyberSec

🚨 Fortinet FortiGate SAML SSO Auth Bypass Under Active Exploitation (Patch Now) Threat actors are exploiting CVE-2025-59718 and CVE-2025-59719 (CVSS 9.8) to bypass FortiCloud SSO authentication via crafted SAML messages, then logging in as “admin” and exporting device

FortiOS/FortiGate FortiCloud SSO Login Authentication Bypass Exploit !!! Only for the purpose of security research #FortiOS #FortiGate #CVE-2025-59718 #CVE-2025-59719 https://t.co/gy6uZFdHZO

🚨 𝗖𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗔𝗹𝗲𝗿𝘁: 𝗙𝗼𝗿𝘁𝗶𝗻𝗲𝘁 𝗙𝗼𝗿𝘁𝗶𝗚𝗮𝘁𝗲 𝗩𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗨𝗻𝗱𝗲𝗿 𝗔𝗰𝘁𝗶𝘃𝗲 𝗔𝘁𝘁𝗮𝗰𝗸 CISA has designat

🚨 Fortinet FortiOS [—] Dec 22, 2025 Comprehensive advisory detailing the latest critical vulnerabilities, risks, and response strategies for Fortinet FortiOS, including CVE-2025-59718 and CVE-2025-59719. Checkout our Threat Intelligence Platform:... https://t.co/0zPN4WrnTy

Over 25,000 Fortinet devices with FortiCloud SSO remain exposed online. CVE-2025-59718 and CVE-2025-59719 enable attackers to bypass authentication via malicious SAML messages. #Fortinet #AuthenticationBypass #USA https://t.co/55EANd9dbO

Fortinet SSO Under Siege: There is an active alert regarding 25,000+ Fortinet devices exposed to remote attacks. Threat actors are exploiting critical vulnerabilities (CVE-2025-59718 & CVE-2025-59719) in the FortiCloud Single Sign-On (SSO) feature to bypass authentication.

We added fingerprinting of Fortinet devices with FortiCloud SSO enabled to our Device Identification reporting (at least 25K IPs seen globally). While not necessarily vulnerable to CVE-2025-59718/CVE-2025-59719 if you get a report from us regarding exposure, please verify/patch!

En ciberseguridad IOT, dos nuevas vulnerabilidades en los productos Fortinet están siendo explotadas libremente . Vulnerabilidades CVE-2025-59718 y CVE-2025-59719 La vulnerabilidad, identificada como CVE‑2025‑64446, ha sido catalogada con una puntuación alta CVSS de 9,8/1

FortinetのSSO 脆弱性、公開直後から悪用を確認(CVE-2025-59718,CVE-2025-59719) https://t.co/UF47EROvVn #セキュリティ対策Lab #セキュリティ #Security #サイバー攻撃

For the latest Fortigate CVEs (CVE-2025-59718 & CVE-2025-59719), @HuntressLabs SIEM' is observing the following IPv4s associated with exploitation 📍 38.54.95[.]226 45.32.153[.]218 45.61.136[.]7 167.179.76[.]111 199.247.7[.]82 Detect for .... 🧵 https://t.co/uVNaHmlwF1

🚨 A recently disclosed pair of vulns affecting #Fortinet devices are being actively exploited in the wild. CVE-2025-59718 & CVE-2025-59719, carrying critical CVSSv3 scores, allow an unauthenticated remote attacker to gain device admin access. Read on: https://t.co/ELllZ43

Fortinet auth bypass is being exploited in the wild: CVE-2025-59718 + CVE-2025-59719. If FortiCloud SSO admin login is enabled, attackers can log in as admin via a crafted SAML message.

Fortinet heeft beveiligingsupdates uitgebracht voor FortiOS, FortiProxy, FortiWeb en FortiSwitchManager na meldingen van actief misbruik van twee ernstige kwetsbaarheden. Het gaat om CVE-2025-59718 en CVE-2025-59719, beide met een CVSS-score van 9,8. https://t.co/VNaHagvqqB

#threatreport #LowCompleteness Arctic Wolf Observes Malicious SSO Logins on FortiGate Devices Following Disclosure of CVE-2025-59718 and CVE-2025-59719 | 15-12-2025 Source: https://t.co/NHyKkb4eWR Key details below ↓ 🎯Victims: Fortinet fortigate users, Firewall and vpn http

🚨 Fortinet FortiGate devices are under active attack via SSO authentication bypass flaws. CVE-2025-59718 and CVE-2025-59719 both have CVSS scores of 9.8 and exploit the FortiCloud SSO 🔗 Details → https://t.co/sOvcptoRDG https://t.co/kUb2XJtoeG

‼️Brīdinājums! Atklātas kritiskas ievainojamības FortiOS, FortiProxy, FortiSwitchManager un FortiWeb programmatūrā - CVE-2025-59718 un CVE-2025-59719 (CVSS 9.1) ⚠️Informācija liecina, ka ievainojamības jau tiek aktīvi izmantotas kiberuzbrukumos. Vairāk: https:/

Cybersecurity experts report that threat actors are actively exploiting two newly disclosed vulnerabilities in Fortinet FortiGate devices, utilizing malicious SSO logins and authentication bypasses (CVE-2025-59718 & CVE-2025-59719). https://t.co/PVpSEYEuDW

Hackers exploit CVE-2025-59718 and CVE-2025-59719 to bypass FortiCloud SSO, gaining unauthorized admin access and stealing configs from multiple Fortinet products, excluding FortiOS 6.4a. #FortinetFlaws #SSOBypass #USA https://t.co/IomE0NDthH

Vulnerabilidades crítica en #Fortinet CVE-2025-59718 y CVE-2025-59719 (CVSS: 9.8). FortiCloud SSO está apagado por defecto pero se activa automáticamente cuando el equipo se registra. Se debe deshabilitar manualmente. PARCHEA! https://t.co/jUVf9vMf4B

Fortinet reports active exploitation of FortiGate SSO flaws CVE-2025-59718 and CVE-2025-59719, enabling unauthenticated SAML logins and admin access. Advisory dated Dec 9 2025. #Vuln https://t.co/wdHVq8KxBz

🚨 CRITICAL: Fortinet devices under active attack via two SSO bypass flaws (CVE-2025-59718 & CVE-2025-59719). Attackers are forging SAML messages to gain admin access. Patch NOW or disable FortiCloud SSO! 🔥 #Fortinet #CyberAttack #Vulnerability 🔗 https://t.co/TZTqDIc

🚨 FortiGate SSO Exploit Alert Active attacks exploiting CVE-2025-59718 & CVE-2025-59719 allow unauthenticated SAML-based SSO logins, giving attackers admin access. Affected: FortiOS, FortiWeb, FortiProxy, FortiSwitchManager (FortiCloud SSO enabled) 🔧 Patch immediatel

Fresh Fortinet flaws CVE-2025-59718 & CVE-2025-59719 exploited days after patch release, bypassing FortiCloud SSO via crafted SAML responses. Attacks targeted admin accounts, leading to config theft. #FortinetBreach #SSOAttack #USA https://t.co/kK069S6YBf

🚨 Active Exploitation Alert! Threat actors are actively exploiting two critical FortiGate vulnerabilities (CVE-2025-59718, CVE-2025-59719) that allow SAML SSO authentication bypass when FortiCloud SSO is enabled. #CybersecurityNews Full Story 👉 https://t.co/il1hlxjOFN http

🚨 Fortinet FortiGate devices are under active attack via SSO authentication bypass flaws. CVE-2025-59718 and CVE-2025-59719 both have CVSS scores of 9.8 and exploit the FortiCloud SSO feature. Disable FortiCloud SSO until systems are fully updated. 🔗 Details → https://

Onderzoekers melden actief misbruik in fortinet producten met kwetsbaarheden betreffende kenmerk CVE-2025-59718 en CVE-2025-59719. Lees hier onze update van het beveiligingsadvies: https://t.co/OwAkGwvQKz

FortiGate SSOの重大(Critical)な脆弱性が悪用されている。Arctic Wolf社報告。CVE-2025-59718とCVE-2025-59719で、いずれもCVSSスコア9.1。特定のホスティング事業者群からadminアカウントを直接狙うもの。 https://t.co/2HZP1oYBqZ

Fortinet Patches Critical Authentication Bypass Vulnerabilities Tracked as CVE-2025-59718 and CVE-2025-59719 (CVSS score of 9.8), the two bugs are described as improper verification of cryptographic signature issues. They impact FortiOS, FortiWeb, FortiProxy, and https://t.co/Eo

🔴 CVE-2025-59718 & CVE-2025-59719: Fortinet FortiCloud SSO Auth Bypass Fortinet's got two critical flaws (CVSS 9.6 and 9.8) in FortiCloud SSO allowing complete authentication bypass. What's nasty: CVE-2025-59718 exploits improper session validation—attackers craft ma

🚨🚨CVE-2025-59718 & CVE-2025-59719: FortiCloud SSO Authentication Bypass Unauthenticated attackers may bypass FortiCloud SSO by abusing crafted SAML messages when the feature is enabled. ZoomEye Dork👉app="Fortinet FortiSwitch" || app="Fortinet FortiWeb" || app="Forti