FortiGate CVE-2025-59718 Exploitation: Incident Response Findings

Rapid7 Incident Response investigated an in-the-wild exploitation of FortiGate appliances abusing CVE-2025-59718, an improper cryptographic signature verification vulnerability that enables an SSO login bypass (Fortinet originally disclosed the issue in Dec 2025). Attackers used a low‑profile approach: gaining access to one appliance, systematically compromising additional firewalls, then pivoting to internal hosts. Rapid7 documents attack progression, investigative methodology for tracing initial access from edge device compromise, and practical detection/response opportunities that allowed R