Fortigate Config Download After SSO Login

Tim Peck@timpeck

•updated Dec 17, 2025•15•0•398

Detects a successful SSO administrative login followed by a system configuration download from the same user and source IP address within 5 minutes. This sequence is a strong indicator of compromise related to CVE-2025-59718 and CVE-2025-59719.