InfoSecBulletin Cybersecurity for mankind
Threat actors started to exploit two critical flaws (CVE: 2025-59718 and CVE: 2025-59719 in Fortinet FortiGate devices. Unauthenticated attackers can exploit these vulnerabilities to bypass SSO login protections using crafted SAML messages when FortiCloud SSO is enabled on affected devices.
December 12, 2025, Arctic Wolf identified coordinated attacks using malicious Single Sign-On (SSO) logins on FortiGate devices globally.
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
Thousands of MCP Servers Exposed to File Access and Injection Attacks
CERT/CC Alerts to Hidden Admin Backdoor in Tenda Router Firmware
Daily Cyber security update for 6. 07. 2026
“Bad Epoll” 0-Day Vulnerability Allows Root Access on Linux Servers, Android Devices
An AI performed a cyber attack without any human help for the first time
Singapore major data centres, cloud providers could incur fine up to $1m
IBM-managed instance breach exposes personal data of 70,000 in Singapore
Alibaba Reportedly Bans Claude Code for Suspected AI Tool Backdoor
FortiOS 6.4, FortiWeb 7.0, and FortiWeb 7.2 remain unaffected by these vulnerabilities.
Fortinet customers who identify related indicators of compromise (IoCs) should assume a breach and reset their hashed firewall credentials from the exposed configurations.
Workaround:
Fortinet recommends turning off the FortiCloud login feature (if enabled) temporarily until upgrading to a non-affected version.
To turn off FortiCloud login, go to System -> Settings -> Switch “Allow administrative login using FortiCloud SSO” to Off.
