Fortinet Confirms Active Exploitation of FortiCloud SSO Vulnerability (CVE-2025-59718 and CVE-2025-59719)

Fortinet has acknowledged that a recently disclosed vulnerability (CVE-2025-59718 and CVE-2025-59719) in its FortiCloud single sign-on service is being actively exploited in the wild. The flaw impacts how authentication tokens are processed, allowing threat actors to bypass normal access controls under certain conditions and gain unauthorized entry into customer environments that rely on FortiCloud for centralized identity management.

The core of the issue stems from inadequate validation of session tokens during the SSO handshake. A malicious actor who can intercept or replay a specially crafted token exchange can manipulate the authentication flow to impersonate legitimate users. Because FortiCloud serves as the authentication authority for multiple Fortinet products and services, successful exploitation can result in access to a wide range of network resources without directly compromising local credentials.

In the observed attacks, adversaries have leveraged this weakness to obtain valid session tokens and escalate privileges within targeted accounts. Once authenticated through the compromised SSO process, they have attempted to access administrative interfaces, export configuration data, and pivot into connected systems. This type of attack can be difficult to detect using traditional log-on monitoring because the session tokens involved appear superficially legitimate.

Fortinet has responded by issuing updated FortiCloud components that incorporate stricter token verification logic and defenses against replay manipulation. Customers using FortiCloud SSO are being urged to apply the update promptly and to enforce multi-factor authentication at every possible enforcement point to limit the impact of any compromised sessions.

In addition to patching, organizations should review recent authentication logs for anomalous patterns such as unexpected token issuances, rapid token reuse, or logins from previously unseen geographic locations. Tightening access controls and implementing network segmentation can further reduce the blast radius if a session token is misused.

Active exploitation of an authentication bypass in a central identity service underscores the importance of defending the authentication layer alongside endpoint and network protection. Identity services that federate access across multiple products represent high-value targets for adversaries, and weaknesses in those services can undermine broader security controls if not addressed quickly.