There seems to be no stopping the cybersecurity incidents in what is now being termed Black October in the cyber space.
The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) has issued a critical alert over vulnerabilities in multiple Fortinet products, warning organisations to patch immediately or risk attackers gaining administrative access to their networks without ever needing a password.
The alert, published on the government’s cyber.gov.au portal, flags two flaws tracked as CVE-2025-59718 and CVE-2025-59719, both carrying a near-maximum CVSS severity score of 9.8 out of 10. The vulnerabilities sit in Fortinet’s FortiCloud Single Sign-On feature and stem from improperly verified SAML digital signatures, meaning an attacker can forge a login assertion and simply walk in as an administrator, no credentials required.
The affected product list is long: FortiOS, FortiProxy, FortiSwitchManager and FortiWeb are all named in the advisory, spanning several version branches across each product line. ASD’s ACSC has urged affected organisations to apply the latest patches without delay, and to investigate their systems for signs that they may have already been compromised, rather than assuming the absence of an alert means the absence of a breach.
What Fortinet actually does
For readers outside the security world, Fortinet is one of the largest cybersecurity vendors on the planet, best known for its FortiGate line of firewalls and its broader FortiOS operating system that powers network security appliances used by governments, banks, hospitals and enterprises worldwide. Its products sit at the edge of corporate networks, deciding what traffic gets in and what gets blocked, which is precisely why a flaw that lets an outsider bypass login screens entirely is treated as critical rather than routine. Fortinet also builds adjacent products like FortiProxy for web filtering and FortiSwitchManager for managing network switches, all of which were swept up in this particular advisory.
That central, trusted position is also what makes Fortinet such an attractive target. Nation-state groups have repeatedly gone after FortiOS vulnerabilities in the past specifically because a single compromised firewall can offer a foothold into an entire organisation’s network, and this is far from Fortinet’s first brush with a critical, actively-targeted flaw.
Part of a brutal stretch for enterprise security
The timing is notable. This alert lands in the middle of what several executives have taken to publicly describing as one of the roughest periods the software industry has faced in years, with Salesforce and Shopify’s chief executives both sounding alarms over the pace of recent incidents. Just this week, a critical flaw in PHP, the language that still underpins a huge share of the web, sent companies scrambling, and even drew public warnings from Japan’s prime minister and America’s FBI. Cloudflare’s own CEO described exploit attempts against that PHP bug jumping from thousands to millions within hours of disclosure.
The same stretch has seen Node.js patch a critical Brotli decoder flaw that could allow remote code execution, cloud platform Railway disclose a breach serious enough to pause all customer deployments, and digital certificate provider eMudhra watch roughly ₹1,450 crore wiped off its market value in just two days after a certificate key compromise came to light. Fortinet’s FortiCloud SSO bypass simply adds another large, trusted name to that list.
For an industry increasingly building its infrastructure, including the data pipelines and compute clusters behind AI products, on the assumption that the network perimeter will hold, incidents like this are a reminder that the foundational plumbing of the internet is still routinely found to have holes serious enough to hand an attacker the keys outright. Organisations running any of the affected Fortinet products are advised to check the official ACSC alert, apply patches immediately, and, where patching isn’t immediately possible, disable FortiCloud SSO login as a temporary safeguard.