CVE-2025-59718
Published: 09 December 2025
Summary
CVE-2025-59718 is a critical-severity Improper Verification of Cryptographic Signature (CWE-347) vulnerability in Fortinet Fortiproxy. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 7.7% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-5 (Security Alerts, Advisories, and Directives).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely patching of the improper cryptographic signature verification flaw in affected Fortinet products, directly eliminating the SAML authentication bypass vulnerability.
Mandates receiving and implementing Fortinet PSIRT advisories and CISA KEV catalog entries for this known exploited vulnerability to enable rapid remediation.
Enforces integrity verification mechanisms for information such as SAML response messages, comprehensively addressing improper cryptographic signature validation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote bypass of FortiCloud SSO via crafted SAML responses due to improper signature verification, enabling exploitation of public-facing applications/management interfaces (T1190, T1210) and forging SAML tokens (T1606.002).
NVD Description
A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiProxy 7.6.0 through 7.6.3, FortiProxy 7.4.0 through 7.4.10, FortiProxy 7.2.0 through 7.2.14, FortiProxy 7.0.0 through…
more
7.0.21, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows an unauthenticated attacker to bypass the FortiCloud SSO login authentication via a crafted SAML response message.
Deeper analysisAI
CVE-2025-59718 is an improper verification of cryptographic signature vulnerability, classified under CWE-347, affecting multiple Fortinet products. It impacts FortiOS versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.8, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.17; FortiProxy versions 7.6.0 through 7.6.3, 7.4.0 through 7.4.10, 7.2.0 through 7.2.14, and 7.0.0 through 7.0.21; FortiSwitchManager versions 7.2.0 through 7.2.6 and 7.0.0 through 7.0.5. The flaw enables an unauthenticated attacker to bypass FortiCloud SSO login authentication by sending a crafted SAML response message. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Any unauthenticated attacker with network access can exploit this vulnerability due to its low attack complexity and lack of required privileges or user interaction. Successful exploitation allows bypassing authentication controls, potentially granting unauthorized access to the affected Fortinet devices and enabling high-impact compromises of confidentiality, integrity, and availability.
Fortinet's PSIRT advisory (FG-IR-25-647) details patching and mitigation steps for affected versions. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.
Arctic Wolf has reported observing malicious SSO logins following disclosure of CVE-2025-59718 and CVE-2025-59719, indicating real-world exploitation activity.
Details
- CWE(s)
- KEV Date Added
- 16 December 2025