Active exploitation of vulnerabilities in multiple Fortinet products

Two critical vulnerabilities affecting multiple Fortinet products are reported to be under active exploitation.

CVE-2025-59718 and CVE-2025-59719 involve improper verification of cryptographic signatures which an unauthenticated attacker could use to bypass the FortiCloud SSO login authentication via a crafted SAML response message.

The NCSC is aware of open-source reports of a small number of Fortinet customers observing unexpected logon activity on their devices. Some of these activities were reported on fully upgraded Fortinet devices. Fortinet is working to resolve this vulnerability and has published mitigation advice in their PSIRT blog. The NCSC encourages organisations that use the affected products to review this information, even if they have upgraded to the latest patch.

The NCSC encourages organisations in New Zealand that use the affected products to review the advisory and apply the remediation as soon as possible. We also urge affected organisations to investigate unauthorised access or compromise of the affected products.