Fortinet admins report compromises on patched FortiGate devices. CVE-2025-59718 bypass actively exploited. What UK businesses must do now to secure network infrastructure
Fortinet customers are reporting that FortiGate firewalls already updated to FortiOS 7.4.9 and 7.4.10 are still being compromised. Attackers are exploiting a patch bypass of critical authentication vulnerability CVE-2025-59718, gaining full administrative control even on supposedly "patched" systems.
If your business uses Fortinet firewalls, this is not a routine security update. This is an active incident requiring immediate action.
Quick Facts:
The vulnerability stems from improper verification of cryptographic signatures in SAML messages used by FortiCloud single sign-on (SSO). When FortiCloud SSO administrative login is enabled, an unauthenticated attacker can craft a malicious SAML response that grants admin access without valid credentials.
In plain English: your firewall's management interface becomes publicly accessible to anyone who knows how to exploit this flaw.
What attackers are doing:
This isn't theoretical. UK organisations and international firms are reporting compromises on devices running the supposedly fixed firmware versions.
Here's the critical part: administrators report successful attacks on FortiGate appliances that had already been upgraded to FortiOS 7.4.9 and 7.4.10. Fortinet has reportedly confirmed the vulnerability persists in version 7.4.10.
This is what security professionals call a patch bypass. The underlying logic flaw in the authentication flow remains exploitable under certain conditions, even after the first round of patches.
Fortinet is preparing fully remediated versions:
Until these versions are released and deployed, organisations with FortiCloud SSO enabled remain at risk.
Your organisation is potentially vulnerable if:
Important detail: FortiCloud SSO admin login is often automatically enabled during FortiCare registration unless an administrator explicitly opts out. Many organisations don't realise this feature is active.
Even if you're not using FortiCloud SSO for day-to-day operations, if it's enabled in the configuration, you're exposed.
Via GUI:
Via CLI:
show system global | grep admin-forticloud-sso-login
If this shows enable, you need to act immediately.
Unless you absolutely need FortiCloud SSO for administrator access, turn it off right now.
Via GUI:
Via CLI:
config system global
set admin-forticloud-sso-login disable
end
This single configuration change removes the attack vector entirely.
Your firewall's management interface should never be accessible from the open internet.
Implement these controls immediately:
If you're not certain how your management access is configured, assume it's exposed and audit it now.
Look for:
Where to check:
If you don't have centralised logging, set it up. You can't investigate what you haven't recorded.
If you discover suspicious activity, assume full device compromise.
Required response steps:
When Fortinet releases FortiOS 7.4.11, 7.6.6, and 8.0.0, you need to schedule emergency change windows to apply them immediately.
Don't wait for your normal monthly patching cycle. This is a critical, actively exploited vulnerability with proof of concept code in circulation.
If you manage Fortinet infrastructure for multiple clients:
Create a standard incident response runbook:
Your clients are relying on you to protect them. Proactive communication and rapid response separates professional MSPs from order-takers.
This isn't a "maybe someone could exploit this" scenario. CISA (US Cybersecurity and Infrastructure Security Agency) has added CVE-2025-59718 to their Known Exploited Vulnerabilities catalogue and ordered federal agencies to remediate quickly.
UK organisations face similar scrutiny from:
Failing to act on known, actively exploited vulnerabilities becomes increasingly difficult to justify.
Your firewall sits at the boundary of your network. Compromising it gives an attacker:
A compromised firewall isn't just a security incident. It's a potential business continuity crisis.
This vulnerability highlights a broader risk: cloud identity integrations on security appliances must be treated as high-risk components, not convenience features.
Many organisations enable SSO for "ease of management" without considering:
Convenience and security often compete. Make conscious trade-offs, don't accept defaults.
This incident demonstrates why patch management alone isn't sufficient security practice.
A comprehensive approach requires:
Your firewall's admin interface is a critical security boundary. Treat it accordingly:
If your firewall gets compromised via its management interface, game over.
This is where professional cyber security management services make the difference between quick remediation and business disruption.
What a competent managed cyber security service provider does:
You're not paying for someone to install updates. You're paying for expertise, vigilance, and rapid response when threats emerge.
We don't just patch firewalls. We architect network security with the assumption that any single control can fail.
Our approach to infrastructure security:
We review your security appliances (Fortinet, Cisco, UniFi, and others) against CIS benchmarks and vendor hardening guides. This often reveals that features like FortiCloud SSO are enabled unnecessarily, creating avoidable risk.
Your firewall's admin interface gets the same scrutiny as your DMZ. We implement:
We don't assume firewalls are invulnerable. Our monitoring watches for:
We're not Fortinet partners, Cisco partners, or Palo Alto partners. We assess your security infrastructure objectively and recommend changes based on your risk profile, not vendor relationships.
If your Fortinet firewall is creating more risk than it mitigates, we tell you.
We're offering UK organisations a Fortinet Firewall Health Check this month:
What we assess:
What you receive:
This isn't a sales call disguised as an audit. We document what we find, explain the risks, and provide clear remediation steps whether or not you engage us for implementation.
Book your audit: Contact us or email security@stabilise.io with "Fortinet Audit" in the subject line.
If you're running FortiOS 7.4.9 or 7.4.10, yes. Field reports confirm these versions remain vulnerable to the patch bypass. Disable FortiCloud SSO admin login unless you have a specific operational requirement for it.
Consider alternative approaches:
If you must use FortiCloud SSO, implement compensating controls: IP allowlisting, dedicated management VLAN, enhanced monitoring, and immediate upgrade to fixed versions when available.
Review authentication logs for:
If your logs don't go back far enough, that's a separate problem. Implement 90-day log retention minimum.
Technically yes, but it's not sufficient. The vulnerability exists in the SSO authentication mechanism. If an attacker gains access to your network through other means (phishing, compromised VPN, supplier access), they could still exploit it internally.
Defence in depth: disable unnecessary features AND restrict management access.
A firewall is a tool. Cyber security services involve:
You wouldn't buy a defibrillator and consider yourself protected against heart attacks. The tool matters, but expertise in using it matters more.
Not necessarily. Every firewall vendor has vulnerabilities at some point. The question is:
Fortinet makes solid products, but this incident highlights the importance of configuration management and not just relying on vendor defaults.
Cyber Essentials Plus requires that security patches are applied promptly. With CVE-2025-59718:
UK assessors will expect evidence you responded to critical vulnerabilities within days, not weeks.
Minimum:
If you have a managed cyber security services provider, they should be doing this continuously.
If you're responsible for Fortinet infrastructure in a UK business:
If you don't have the expertise or resources to do this quickly, that's what professional IT support services are for.
This is the difference between reading about security incidents in the news and being in the news about a security incident.
We're technology advisors who specialise in network security and infrastructure for London businesses. We manage security appliances across Fortinet, Cisco, UniFi, and other platforms, with a focus on configuration hardening and defence-in-depth.
Unlike commodity IT support companies, we employ certified security engineers who understand both the technical details of vulnerabilities like CVE-2025-59718 and the business impact of getting security decisions wrong.
What makes us different:
If you're a London business looking for cyber security management services that go beyond "patch and pray," let's talk.
Last updated: 22 January 2026
Classification: Public security advisory
Sharing: You may share this article with colleagues and industry contacts
Sources:
Need immediate assistance with Fortinet firewall security? Email security@stabilise.io or call our security team on +44 203 355 7522
