erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: December 9, 2025

1 editorial brief, 2 known exploited (cisa kev) additions and 6 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: FortiCloud SSO SAML Bypass: CVE-2025-59718/59719. Owners of FortiGate (FortiOS 7.0-7.6), FortiProxy, FortiWeb 7.4-8.0 or FortiSwitchManager devices that were registered to FortiCare from the GUI without turning off FortiCloud SSO login.
  • Do you run any of these? Microsoft Windows, RARLAB WinRAR. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-12-30.
  • Maven: 2 critical advisories (net.sf.robocode:robocode.core, net.sf.robocode:robocode.battle). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • Composer (PHP): 2 critical advisories (neuron-core/neuron-ai, onelogin/php-saml). Check with composer audit.
  • npm: 1 critical advisory (elysia). Check with npm audit (or: npm ls <package>).
  • PyPI: 1 critical advisory (cai-framework). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2025-59718, CVE-2025-59719

FortiCloud SSO SAML Bypass: CVE-2025-59718/59719

If any Fortinet device has FortiCloud SSO admin login turned on, it was open to unauthenticated admin takeover; upgrade, then also apply the January 2026 fix for CVE-2026-24858, which bypassed this patch.

Must act: Owners of FortiGate (FortiOS 7.0-7.6), FortiProxy, FortiWeb 7.4-8.0 or FortiSwitchManager devices that were registered to FortiCare from the GUI without turning off FortiCloud SSO login.

Can relax: FortiOS 6.4 and FortiWeb 7.2 and older are not affected, and devices where admin-forticloud-sso-login is disabled were not exposed to this bug.

  1. Check whether FortiCloud SSO admin login is on: show system global | grep forticloud-sso.
  2. Disable it until patched: config system global / set admin-forticloud-sso-login disable / end.
  3. Upgrade to the latest release on your train, which also covers CVE-2026-24858 from January 2026 (FortiOS 7.6.6, 7.4.11, 7.2.13, 7.0.19 or later).

Read the brief →

Known exploited (CISA KEV) 2

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2025-62221Microsoft Windows
Microsoft Windows Use After Free Vulnerability		2025-12-30
CVE-2025-6218RARLAB WinRAR
RARLAB WinRAR Path Traversal Vulnerability		2025-12-30

Critical advisories by ecosystem 6

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Composer (PHP) 2

Check: composer audit

Maven 2

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

npm 1

Check: npm audit (or: npm ls <package>)

PyPI 1

Check: pip-audit (or: pip show <package>)