✕
Request a Demo
Rewterz
NVIDIA Isaac Lab Flaw Enables Remote Code Execution
December 17, 2025
Rewterz
GCleaner Malware – Active IOCs
December 18, 2025

CISA Lists Actively Exploited Fortinet Vulnerability in KEV Catalog

Severity

High

Analysis Summary

On December 16, 2025, CISA officially added CVE-2025-59718 to its Known Exploited Vulnerabilities (KEV) catalog, designating a critical remediation deadline of December 23, 2025. This vulnerability is actively exploited in the wild, posing an immediate threat to enterprise networks. It affects multiple Fortinet products, including FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb, and allows attackers to bypass FortiCloud Single Sign-On (SSO) via specially crafted SAML messages, effectively granting unauthorized network access without valid credentials.

The flaw stems from improper verification of cryptographic signatures (CWE-347), making it an authentication bypass vulnerability. A related vulnerability, CVE-2025-59719, shares the same root cause and is documented alongside CVE-2025-59718, emphasizing the need for comprehensive patching across all affected systems. The attack vector is unauthenticated and network-based, meaning attackers do not require prior access or credentials to exploit the flaw, increasing its risk for exposed edge security devices and web application firewalls.

Fortinet has released vendor advisories addressing the issue, and administrators are urged to apply all available patches immediately. CISA’s inclusion of this vulnerability in the KEV catalog mandates compliance with federal security guidance, particularly for organizations operating cloud services. Agencies and enterprises are advised to follow BOD 22-01 guidance when implementing Fortinet cloud solutions, while environments unable to patch immediately should consider discontinuing vulnerable products until mitigations are verified.

Security teams must prioritize inventory audits of affected Fortinet products and initiate emergency patching procedures to meet the December 23 deadline. While there is no confirmed link to ransomware campaigns at present, the active exploitation underscores the urgency of remediation. Timely patching is critical to prevent credential-free network intrusion and maintain regulatory compliance, especially for systems exposed to the internet or handling sensitive enterprise data.

Impact

  • Security Bypass
  • Gain Access

Indicators of Compromise

CVE

  • CVE-2025-59719

  • CVE-2025-59718

Affected Vendors

Fortinet

Remediation

  • Apply all available Fortinet vendor patches for FortiOS, FortiSwitchMaster, FortiProxy, and FortiWeb without delay.
  • Ensure related vulnerability CVE-2025-59719 is also patched across all affected systems.
  • Identify all Fortinet products in use, including cloud and on-premises environments, to ensure no device is overlooked.
  • For agencies and organizations using cloud services, implement BOD 22-01 guidance when deploying Fortinet cloud solutions.
  • If immediate patching is not possible, discontinue use of affected products until mitigations are verified.
  • Review and limit internet exposure of edge security devices and web application firewalls that may be vulnerable.
  • Activate patch management cycles to prioritize remediation before December 23, 2025.
  • Continuously monitor logs and network activity for signs of unauthorized access or suspicious SAML authentication attempts.