CVE-2025-59718

Published Dec 9, 2025

Last updated a month ago

Fortinet FortiOS

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-59718 is a vulnerability affecting Fortinet's FortiOS, FortiProxy, and FortiSwitchManager. It stems from an improper verification of cryptographic signatures, which could allow an unauthenticated attacker to bypass FortiCloud Single Sign-On (SSO) login authentication. This bypass is possible through a crafted Security Assertion Markup Language (SAML) message, but only if the FortiCloud SSO login feature is enabled on the device. The FortiCloud SSO login feature is not enabled by default in factory settings. However, it becomes enabled when an administrator registers the device with FortiCare via the GUI, unless the administrator specifically disables the "Allow administrative login using FortiCloud SSO" option during registration.

Description: A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
Source: psirt@fortinet.com
NVD status: Analyzed
Products: fortiproxy, fortiswitchmanager, fortios

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
Exploit added on: Dec 16, 2025
Exploit action due: Dec 23, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

psirt@fortinet.com: CWE-347

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 21

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FD1BE28E-8FDA-4DA9-9DA8-EF5266CD3C54",
            "versionEndExcluding": "7.0.22",
            "versionStartIncluding": "7.0.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4B2E82CF-00E9-4D67-B472-E54A325F87FC",
            "versionEndExcluding": "7.2.15",
            "versionStartIncluding": "7.2.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F989EFB6-A5C9-414B-A85B-786D309B41AF",
            "versionEndExcluding": "7.4.11",
            "versionStartIncluding": "7.4.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "11CA0204-FD63-4614-821E-E2C4E34F7979",
            "versionEndExcluding": "7.6.4",
            "versionStartIncluding": "7.6.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F1B9AA70-BB46-403B-94C1-D94C64E22334",
            "versionEndExcluding": "7.0.6",
            "versionStartIncluding": "7.0.0"
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EE22A407-02CB-4979-A38D-9EBAFEB350F6",
            "versionEndExcluding": "7.2.7",
            "versionStartIncluding": "7.2.0"
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BCEB8B8A-797C-4E5E-BCDB-A54EB83AD8A2",
            "versionEndExcluding": "7.0.18",
            "versionStartIncluding": "7.0.0"
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E8FAAA2E-7A53-4F6B-A9C7-1E2B4CB5F7EB",
            "versionEndExcluding": "7.2.12",
            "versionStartIncluding": "7.2.0"
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2093EFE3-4B7F-4806-9850-C42B26BC64AC",
            "versionEndExcluding": "7.4.9",
            "versionStartIncluding": "7.4.0"
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C1C30E0D-7F09-42D2-9EB1-E2196BD50D75",
            "versionEndExcluding": "7.6.4",
            "versionStartIncluding": "7.6.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.