Massive FortiCloud SSO Exposure Leaves 25,000+ Devices Vulnerable

The Shadowserver Foundation has identified over 25,000 internet-facing systems globally with Fortinet devices configured to use FortiCloud Single Sign-On (SSO), potentially exposing them to critical security vulnerabilities tracked as CVE-2025-59718 and CVE-2025-59719.

The nonprofit security organization recently added fingerprinting capabilities for Fortinet devices with FortiCloud SSO to its Device Identification reporting system.

This proactive scanning effort aims to help organizations identify potentially vulnerable systems before threat actors can exploit them.

Sponsored

class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">

https://twitter.com/Shadowserver/status/2001988423247339649?ref_src=twsrc%5Etfw

Critical Vulnerabilities Pose Serious Risk

CVE-2025-59718 has been added to CISA’s Known Exploited Vulnerabilities Catalog, indicating active exploitation or significant threat potential.

This designation requires federal agencies to patch affected systems urgently under CISA’s Binding Operational Directive 22-01.

The companion vulnerability, CVE-2025-59719, raises additional security concerns for FortiCloud SSO implementations.

While not all 25,000 identified systems are necessarily vulnerable to these specific CVEs, the widespread exposure creates a significant attack surface for potential exploitation.

Organizations using Fortinet devices with FortiCloud SSO enabled should treat this as a high-priority security alert.

The Shadowserver Foundation is actively notifying affected organizations through its reporting system.

Network administrators receiving exposure reports should immediately verify their systems’ vulnerability status and apply available security patches from Fortinet.

Organizations should review their Fortinet device configurations, particularly those with FortiCloud SSO enabled, to determine if they are running affected versions.

Even if specific vulnerability confirmation is unclear, administrators should prioritize patching and implementing additional security measures.

Security teams should inventory all Fortinet devices in their infrastructure, disable FortiCloud SSO if not actively required, apply the latest security updates from Fortinet, and monitor network traffic for suspicious authentication attempts targeting FortiCloud SSO functionality.

The discovery highlights the importance of continuous security monitoring and rapid vulnerability response, especially for internet-facing enterprise infrastructure components.

Follow us on Google News , LinkedIn and X to Get More Instant Updates, Set Cyberpress as a Preferred Source in Google.

The post Massive FortiCloud SSO Exposure Leaves 25,000+ Devices Vulnerable appeared first on Cyber Security News.