TLDR Tech / InfoSec
Fortinet patches FortiGate Firewall vulnerabilities that allowed hackers to steal enterprise credentials
SentinelOne observed attackers exploiting three critical CVSS 9.8 vulnerabilities in FortiGate NGFWs between December 2025 and February 2026: CVE-2025-59718 and CVE-2025-59719, both stemming from improper cryptographic signature verification, which allowed unauthenticated attackers to forge SAML tokens and gain administrative access. CVE-2026-24858 was exploited as a zero-day to log into devices using an alternative account. CVE-2025-59718 was added to CISA's KEV catalog in late January 2026. Fortinet responded by suspending FortiCloud SSO before releasing a firmware patch. Defenders should apply the patch immediately, rotate all LDAP and AD credentials associated with FortiGate devices, enforce strong admin access controls, audit mS-DS-MachineAccountQuota settings, and monitor EDR telemetry from servers adjacent to the NGFW for unauthorized local admin account creation.
Read the full story