FortiGate FortiCloud SSO SAML bypass used for admin logins and config theft
After Fortinet's December 9, 2025 advisory for CVE-2025-59718 and CVE-2025-59719, which let a crafted SAML message bypass FortiCloud SSO login, Arctic Wolf observed malicious SSO logins against FortiGate admin accounts from December 12, followed by exports of device configurations to the same IP addresses. CISA added CVE-2025-59718 to its Known Exploited Vulnerabilities catalog on December 16.
- Victim
- Multiple: FortiGate devices with FortiCloud SSO enabled
- Industry
- Technology
- Country
- Global
- Intrusion began
- Dec 12, 2025
- First disclosed
- Dec 16, 2025
- Actor
- Unattributed
- Initial access
- Identity infrastructure vulnerability
- Identity control that failed
- Directory and trust
- MFA
- Not applicable (no interactive login)
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
The firewall accepted a forged SAML assertion as an admin login. Disabling cloud SSO on management interfaces until patched, restricting management access to trusted networks, and treating exported configs as exposed credentials are the controls.
Go deeper on SWI
Sources
- Fortinet FortiGate Under Active Attack Through SAML SSO Authentication Bypass, The Hacker News, Dec 16, 2025
- Attackers are exploiting auth bypass vulnerability on FortiGate firewalls (CVE-2025-59718), Help Net Security, Dec 17, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- FortiCloud SSO bypass hits FortiGates already patched for CVE-2025-59718 2026 · Identity infrastructure vulnerability
- Storm-0558 forged Microsoft tokens to read Exchange Online mail 2023 · Identity infrastructure vulnerability
- BeyondTrust Remote Support zero-day used to dump the appliance credential vault 2026 · Identity infrastructure vulnerability
- N-able N-central authentication bypass used to reach managed customer networks 2026 · Identity infrastructure vulnerability
Cite this record
SWI Community Team. (2026). FortiGate FortiCloud SSO SAML bypass used for admin logins and config theft. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-fortigate-forticloud-sso-saml-bypass/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.