CVE-2025-59718

Published Dec 9, 2025

Last updated 4 months ago

Exploit known CVSS critical 9.8

Fortinet FortiOS

Network

API

Supply chain

VPN

Firmware

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-59718 is a vulnerability affecting Fortinet's FortiOS, FortiProxy, and FortiSwitchManager. It stems from an improper verification of cryptographic signatures, which could allow an unauthenticated attacker to bypass FortiCloud Single Sign-On (SSO) login authentication. This bypass is possible through a crafted Security Assertion Markup Language (SAML) message, but only if the FortiCloud SSO login feature is enabled on the device. The FortiCloud SSO login feature is not enabled by default in factory settings. However, it becomes enabled when an administrator registers the device with FortiCare via the GUI, unless the administrator specifically disables the "Allow administrative login using FortiCloud SSO" option during registration.

Description: A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
Source: psirt@fortinet.com
NVD status: Analyzed
Products: fortiproxy, fortiswitchmanager, fortios

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
Exploit added on: Dec 16, 2025
Exploit action due: Dec 23, 2025
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

psirt@fortinet.com: CWE-347

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "FD1BE28E-8FDA-4DA9-9DA8-EF5266CD3C54",
            "versionEndExcluding": "7.0.22",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "4B2E82CF-00E9-4D67-B472-E54A325F87FC",
            "versionEndExcluding": "7.2.15",
            "versionStartIncluding": "7.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F989EFB6-A5C9-414B-A85B-786D309B41AF",
            "versionEndExcluding": "7.4.11",
            "versionStartIncluding": "7.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiproxy:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "11CA0204-FD63-4614-821E-E2C4E34F7979",
            "versionEndExcluding": "7.6.4",
            "versionStartIncluding": "7.6.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F1B9AA70-BB46-403B-94C1-D94C64E22334",
            "versionEndExcluding": "7.0.6",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:fortinet:fortiswitchmanager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "EE22A407-02CB-4979-A38D-9EBAFEB350F6",
            "versionEndExcluding": "7.2.7",
            "versionStartIncluding": "7.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "BCEB8B8A-797C-4E5E-BCDB-A54EB83AD8A2",
            "versionEndExcluding": "7.0.18",
            "versionStartIncluding": "7.0.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E8FAAA2E-7A53-4F6B-A9C7-1E2B4CB5F7EB",
            "versionEndExcluding": "7.2.12",
            "versionStartIncluding": "7.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "2093EFE3-4B7F-4806-9850-C42B26BC64AC",
            "versionEndExcluding": "7.4.9",
            "versionStartIncluding": "7.4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:fortinet:fortios:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C1C30E0D-7F09-42D2-9EB1-E2196BD50D75",
            "versionEndExcluding": "7.6.4",
            "versionStartIncluding": "7.6.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.