Fortinet products hit by new security vulnerabilities, allowing hackers to access systems and more

• Two critical SAML signature vulnerabilities (CVE‑2025‑59718/59719) allow attackers to bypass SSO on several Fortinet products.
• The exploitation began on December 12, with intruders extracting configuration files that exposed network configuration and hashed passwords.
• Fortinet recommends disabling the FortiCloud connection and immediately upgrading to the listed patched versions.

Two new critical vulnerabilities have been discovered in Fortinet products, and as they are actively exploited in the wild, the company and security researchers are urging users to upgrade to the latest version as soon as possible.

In a recently published security advisory (via BeepComputer), Fortinet said it discovered an SSO authentication bypass bug in FortiOS, FortiProxy and FortiSwitchManager, caused by incorrect verification of cryptographic signatures in SAML messages.