top of page
perceptive_background_267k.jpg

Over 25,000 FortiCloud SSO devices exposed to remote attacks

Published:

19 december 2025 om 15:00:45

Alert date:

19 december 2025 om 15:02:36

Source:

bleepingcomputer.com

Click to open the original link from this advisory

Network Infrastructure, Identity & Access, Zero-Day Vulnerabilities

Over 25,000 Fortinet devices with FortiCloud SSO enabled are exposed online and vulnerable to remote attacks. The exposure comes amid ongoing attacks targeting a critical authentication bypass vulnerability in Fortinet systems. Internet security watchdog Shadowserver discovered these vulnerable devices, highlighting the significant security risk to organizations using FortiCloud SSO authentication. The vulnerability allows attackers to bypass authentication mechanisms and potentially gain unauthorized access to affected systems. This represents a large-scale exposure of enterprise authentication infrastructure.

Technical details

The vulnerability exploits improper verification of cryptographic signature weaknesses in FortiCloud SSO via maliciously crafted SAML messages. Attackers can gain admin-level access to web management interfaces and download system configuration files containing potentially vulnerable interfaces, hashed passwords, internet-facing services, network layouts, and firewall policies. The FortiCloud SSO feature is enabled when devices are registered with FortiCare support service. Over 25,000 IP addresses with FortiCloud SSO fingerprint have been identified, with over 5,400 in the US and nearly 2,000 in India.

Mitigation steps:

Apply patches released by Fortinet on December 9th for CVE-2025-59718 and CVE-2025-59719. US government agencies must patch by December 23rd per CISA's Binding Operational Directive 22-01. Organizations should secure admin interfaces from public internet access and monitor for unauthorized SSO login attempts.

Affected products:

FortiOS
FortiProxy
FortiSwitchManager
FortiWeb

Related links:

Related CVE's:

Related threat actors:

IOC's:

Maliciously crafted SAML messages, FortiCloud SSO fingerprint on exposed devices, Coathanger remote access trojan (RAT) malware

This article was created with the assistance of AI technology by Perceptive.

© 2025 by Perceptive Security. All rights reserved.

email: info@perceptivesecurity.com

Deze website toont informatie afkomstig van externe bronnen; Perceptive aanvaardt geen verantwoordelijkheid voor de juistheid, volledigheid of actualiteit van deze informatie.

bottom of page