CVE-2025-59718

Published Dec 9, 2025

Last updated 4 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-59718 is a vulnerability affecting Fortinet's FortiOS, FortiProxy, and FortiSwitchManager. It stems from an improper verification of cryptographic signatures, which could allow an unauthenticated attacker to bypass FortiCloud Single Sign-On (SSO) login authentication. This bypass is possible through a crafted Security Assertion Markup Language (SAML) message, but only if the FortiCloud SSO login feature is enabled on the device. The FortiCloud SSO login feature is not enabled by default in factory settings. However, it becomes enabled when an administrator registers the device with FortiCare via the GUI, unless the administrator specifically disables the "Allow administrative login using FortiCloud SSO" option during registration.

Description: A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
Source: psirt@fortinet.com
NVD status: Analyzed
Products: fortiproxy, fortiswitchmanager, fortios

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@fortinet.com: CWE-347

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C7C1BB39-5796-4CFE-943D-CB94FE932B1D",
            "versionEndIncluding": "7.0.21",
            "versionStartIncluding": "7.0.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "827ACF40-2F2D-455F-B4B1-4D96F7C343DA",
            "versionEndIncluding": "7.2.14",
            "versionStartIncluding": "7.2.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1CA90D56-A627-4664-90E4-AB5F87E68E04",
            "versionEndIncluding": "7.4.10",
            "versionStartIncluding": "7.4.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "DF573060-732A-465A-B6C0-87F3196EA8C0",
            "versionEndIncluding": "7.6.3",
            "versionStartIncluding": "7.6.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "91C92D2D-D834-4FE9-B34D-A606A923426B",
            "versionEndIncluding": "7.0.5",
            "versionStartIncluding": "7.0.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2EADD2C9-04B9-44D0-8F8B-026E2D0EAA3C",
            "versionEndIncluding": "7.2.6",
            "versionStartIncluding": "7.2.0"
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E87C0DD6-A590-4E5E-8F63-481E15647BF9",
            "versionEndIncluding": "7.0.17",
            "versionStartIncluding": "7.0.0"
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1E2C05DC-760B-4A39-8FC5-F485C28E34DB",
            "versionEndIncluding": "7.2.11",
            "versionStartIncluding": "7.2.0"
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ACF34737-DB9E-4E9D-80A1-6185BFFEB8D0",
            "versionEndIncluding": "7.4.8",
            "versionStartIncluding": "7.4.0"
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "83A9230A-728D-4F1F-BF23-D77EA71CF0BD",
            "versionEndIncluding": "7.6.3",
            "versionStartIncluding": "7.6.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.