Threat actors are actively exploiting two critical Fortinet authentication bypass flaws to gain unauthorized administrative access to affected devices and exfiltrate sensitive system configuration files, with exploitation observed less than a week after public disclosure. The vulnerabilities, tracked as CVE-2025-59718 and CVE-2025-59719 (CVSS 9.8), stem from improper cryptographic signature validation of SAML messages and impact multiple Fortinet products, including FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, when FortiCloud single sign-on (SSO) is enabled (a feature that is disabled by default but often automatically activated during FortiCare device registration unless explicitly turned off). Arctic Wolf observed malicious SSO logins beginning December 12, 2025, originating from infrastructure linked to The Constant Company, BL Networks, and Kaopu Cloud HK, where attackers targeted the administrator account, accessed web management interfaces, and exported device configuration files that may expose network topology, firewall policies, routing information, internet-facing services, and hashed credentials susceptible to offline cracking. The activity appears opportunistic and in early stages, but the deliberate exfiltration of configuration data suggests intent beyond simple vulnerability scanning and may enable follow-on attacks. In response to confirmed exploitation in-the-wild, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-59718 to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of no later than December 23, 2025. Fortinet has released patches across affected product lines, and CTIX analysts advise organizations to follow the guidance and immediately upgrade, temporarily disable FortiCloud SSO until remediation is complete, restrict management interface access to trusted networks, and rotate credentials if any indicators of compromise are detected.