What’s Vulnerable › Vulnerabilities
CVE-2025-59718: Fortinet Multiple Products Improper Verification of Cryptographic Signature Vulnerability
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2025-12-16
- EPSS: 68.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-09 · updated 2026-06-17
- Weakness: CWE-347
Description
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through 7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
Summary
CVE-2025-59718 is a critical (CVSS 9.8) improper signature verification flaw in Fortinet FortiOS, FortiProxy and FortiSwitchManager that lets an unauthenticated attacker bypass FortiCloud SSO login using a crafted SAML response. It affects FortiOS 7.0.0-7.0.17, 7.2.0-7.2.11, 7.4.0-7.4.8 and 7.6.0-7.6.3; FortiProxy 7.0.0-7.0.21, 7.2.0-7.2.14, 7.4.0-7.4.10 and 7.6.0-7.6.3; and FortiSwitchManager 7.0.0-7.0.5 and 7.2.0-7.2.6. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation and a 68.3% EPSS probability, so treat it as urgent. Upgrade to FortiOS 7.0.18, 7.2.12, 7.4.9 or 7.6.4; FortiProxy 7.0.22, 7.2.15, 7.4.11 or 7.6.4; and FortiSwitchManager 7.0.6 or 7.2.7, and apply vendor mitigations or discontinue use where patching is not possible.
تُعدّ CVE-2025-59718 ثغرة حرجة (CVSS 9.8) في التحقق غير الصحيح من التوقيع التشفيري ضمن Fortinet FortiOS وFortiProxy وFortiSwitchManager، وتتيح لمهاجم غير مُصادَق عليه تجاوز مصادقة FortiCloud SSO عبر رسالة SAML مُصمَّمة. تشمل الإصدارات المتأثرة FortiOS 7.0.0-7.0.17 و7.2.0-7.2.11 و7.4.0-7.4.8 و7.6.0-7.6.3، وFortiProxy 7.0.0-7.0.21 و7.2.0-7.2.14 و7.4.0-7.4.10 و7.6.0-7.6.3، وFortiSwitchManager 7.0.0-7.0.5 و7.2.0-7.2.6. الثغرة مُدرجة في كتالوج CISA للثغرات المعروفة قيد الاستغلال مع استغلال نشط واحتمال EPSS بنسبة 68.3%، لذا يجب التعامل معها بشكل عاجل. يُنصح بالترقية إلى FortiOS 7.0.18 أو 7.2.12 أو 7.4.9 أو 7.6.4، وFortiProxy 7.0.22 أو 7.2.15 أو 7.4.11 أو 7.6.4، وFortiSwitchManager 7.0.6 أو 7.2.7، مع تطبيق إرشادات التخفيف من المورّد أو إيقاف استخدام المنتج إن تعذّر الترقيع.
Affected products
- Fortinet FortiOS (FortiGate): from 7.0.0 before 7.0.18; from 7.2.0 before 7.2.12; from 7.4.0 before 7.4.9; from 7.6.0 before 7.6.4 — fixed in 7.0.18, 7.2.12, 7.4.9, 7.6.4
- Fortinet FortiProxy: from 7.0.0 before 7.0.22; from 7.2.0 before 7.2.15; from 7.4.0 before 7.4.11; from 7.6.0 before 7.6.4 — fixed in 7.0.22, 7.2.15, 7.4.11, 7.6.4
- Fortinet FortiSwitchManager: from 7.0.0 before 7.0.6; from 7.2.0 before 7.2.7 — fixed in 7.0.6, 7.2.7
- Siemens Ruggedcom Ape1808 Firmware: all versions
How to fix
Upgrade to a fixed version: Fortinet FortiOS (FortiGate) 7.0.18, 7.2.12, 7.4.9, 7.6.4; Fortinet FortiProxy 7.0.22, 7.2.15, 7.4.11, 7.6.4; Fortinet FortiSwitchManager 7.0.6, 7.2.7. Check the vendor advisory for mitigations.
References
- https://fortiguard.fortinet.com/psirt/FG-IR-25-647
- https://arcticwolf.com/resources/blog/arctic-wolf-observes-malicious-sso-logins-following-disclosure-cve-2025-59718-cve-2025-59719/
- https://cert-portal.siemens.com/productcert/html/ssa-864900.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-59718
Get alerted when CVE-2025-59718 or the next vulnerability affects your stack