Rapid7 Details FortiGate CVE-2025-59718 Exploitation and Incident Response Findings

Apr 9, 2026 · Original article ↗

Summary

Rapid7’s incident response team reports that attackers exploited CVE-2025-59718 to bypass FortiGate SSO, create accounts, download configurations, and enter an internal network. The investigation traces credential theft, lateral movement, and detection opportunities.

Key points

Rapid7 says attackers exploited CVE-2025-59718 to bypass SSO authentication on a FortiGate appliance; the organization involved is not named.
The investigation found that attackers enabled SSL VPN, changed firewall settings, created administrative accounts, and downloaded a device configuration.
Rapid7 traced initial access to administrative SSO logins and reported no evidence of brute-forcing the local accounts.
Attackers used Mimikatz to harvest credentials, then used PsExec and RDP while scanning the network and targeting virtualization, domain controller, and backup systems.
Rapid7 reports that the first identified FortiGate access preceded later malicious activity by about two weeks; responders correlated firewall logs, authentication records, and endpoint telemetry to reconstruct the timeline.
Rapid7 recommends centralized syslog monitoring for edge devices and says it developed detections for exploitation attempts, configuration downloads, and suspicious SSO logins.

Article Details

Attack Vectors: Attackers exploited CVE-2025-59718 to bypass SSO authentication on FortiGate appliances and gain administrative access.
Attackers enabled SSL VPN, created administrative accounts, modified firewall policies, and downloaded FortiGate configuration files to establish and maintain access.
Mimikatz was used to harvest credentials; attackers then used PsExec and RDP for lateral movement toward virtualization platforms, domain controllers, and backup infrastructure.
Advanced IP Scanner and Advanced port scanner were used to scan internal systems and identify network services.
Defensive Notes: Implement centralized syslog monitoring for edge devices to audit connection attempts, configuration changes, and potential exploit signatures.
Correlate FortiGate system and authentication logs with endpoint telemetry to reconstruct activity and identify earlier intrusion stages.
Review FortiGate account creation, SSL VPN enablement, firewall policy changes, configuration downloads, and external SSO logins.
Rapid7 reports detections for exploitation attempts, configuration downloads, and suspicious FortiGate SSO logins.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`openmail[.]pro`	Domain associated in the investigation with newly created attacker administrative accounts.
IPV4	`103[.]20[.]235[.]155`	IP address identified in malicious SSO authentications.
IPV4	`104[.]28[.]227[.]105`	External IP address used for the FortiGate configuration-file download; the article reports the session IP was flagged as malicious by security vendors.
IPV4	`185[.]175[.]59[.]238`	Listed among IP indicators associated with attacker targeting of the FortiGate device and SSO activity.
IPV4	`185[.]219[.]157[.]127`	Listed among IP indicators associated with attacker targeting of the FortiGate device and SSO activity.
IPV4	`198[.]98[.]54[.]209`	Attacker IP address identified as targeting the FortiGate device and SSO login.
IPV4	`23[.]163[.]8[.]21`	Listed as an attacker IP address that targeted the FortiGate device.
IPV4	`42[.]200[.]230[.]178`	Listed among IP indicators associated with malicious FortiGate activity.
IPV4	`45[.]32[.]216[.]250`	Attacker IP address shown in FortiGate logs for configuration changes.
IPV4	`45[.]80[.]184[.]229`	Attacker IP address identified as targeting the FortiGate device and SSL VPN.
IPV4	`45[.]80[.]184[.]241`	Listed among IP indicators associated with malicious FortiGate activity.
IPV4	`45[.]80[.]186[.]84`	Listed among IP indicators associated with attacker targeting of the FortiGate device and SSO activity.
IPV4	`45[.]84[.]107[.]17`	IP address identified in malicious interaction with SSL VPN.