Fortinet patches FortiGate Firewall vulnerabilities that allowed hackers to steal enterprise credentials | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker

• SentinelOne reports FortiGate NGFW flaws exploited in early 2026
• Three critical bugs (CVE-2025-59718, -59719, -2026-24858) enabled admin access and persistence
• Fortinet issued patches; firms urged to rotate credentials, enforce strong controls, and monitor for lateral movement

At the start of the year, cybercriminals were exploiting three vulnerabilities in FortiGate Next-Generation Firewalls (NGFW) to establish persistence and move laterally throughout the network. All recorded attacks were stopped before they could do any meaningful harm, and FortiGate has since issued patches to mitigate the risk.

Between December 2025 and February 2026, security researchers SentinelOne observed multiple attacks leveraging three distinct vulnerabilities. The first two are tracked as CVE-2025-59718 and CVE-2025-59719 (severity score 9.8/10), and both are rooted in improper verification of cryptographic signatures. These allow unauthenticated attackers to send a crafted SAML token and thus gain administrative access to FortiGate devices without valid credentials.