FortiGate CVE-2025-59718 Exploitation: Incident Response Findings

Rapid7’s IR team investigated an active exploitation of FortiGate CVE-2025-59718 — an improper verification of cryptographic signature that enables an SSO login bypass on vulnerable FortiGate appliances. Attackers used the flaw to gain initial access, maintained a low-profile presence while compromising additional firewalls, and then moved laterally into internal hosts. Responders were able to contain the intrusion before broader impact. The blog outlines exploitation characteristics, attack progression, and practical detection and response opportunities for defenders.